Legal · Version 1.0 · Not yet in effect
Vulnerability Disclosure Policy
Draft, pending counsel review. This document is a working draft. It has not been reviewed by counsel and is not yet in effect.
We welcome reports from security researchers. This policy tells you how to report a vulnerability in Common Ridge and what we commit to in return.
How to report
Email security@commonridge.com. Include the affected URL or component, the steps to reproduce, the impact you believe it has and any proof of concept. Please do not include real investor data in a report. Our security.txt file lists the same contact.
What we ask of you
- Report promptly and give us reasonable time to fix before you disclose publicly.
- Do not access, change, copy or delete data that is not yours. Stop and tell us as soon as you reach another person's data.
- Test only with accounts you own. Do not run tests that degrade the service, such as denial of service, or social engineering of our staff, customers or investors.
- Do not use physical attacks, and do not attack our providers.
What we commit to
- We will acknowledge your report and keep you informed as we investigate.
- We will not pursue legal action against research that follows this policy and is done in good faith.
- We will credit you if you wish, when the issue is fixed.
Scope
In scope: the websites and applications on commonridge.com and its subdomains, and the public API. Out of scope: customer custom domains that we do not operate, third-party services, and reports of missing best practices with no demonstrated impact.
Rewards
We do not offer a paid bounty at this time. [Counsel to confirm.]