Responsible Disclosure

The short version. Found a security problem? Write to security@codingcords.com. Test in good faith, don't touch other people's data, give us time to fix it, and we will not take action against you.

In scope

codingcords.com, workspace.codingcords.com, the client portal, our API, our browser extension and apps, and our mail and meeting servers.

Out of scope

Denial of service, spam, social engineering of our team or customers, physical attacks, problems in other companies' services (please report those to them), missing best-practice headers with no shown impact, and scanner output without a working proof.

Rules

Use only accounts you create. Never access, change or keep data that is not yours; if you reach some, stop and tell us. Don't degrade the service. Keep the details private until we have fixed the problem or 90 days have passed, whichever comes first.

What we promise

We reply within 3 business days, keep you updated, credit you publicly if you wish, and will not take legal action, or ask anyone else to, over research that follows these rules. We do not run a paid bug bounty yet.