Responsible Disclosure
Policy
This web page represents a legal document with terms and conditions applicable to all individuals who intend to research information security vulnerabilities on Appfarm AS assets. Upon the attempt to uncover vulnerabilities, you are referred to as a “Researcher” and you are bound by and are obligated to comply with the Researcher Terms and Conditions provided on this page.
The Submission Process
If you believe that you have found any vulnerabilities on assets defined in the scope, a thorough report can be submitted to security@appfarm.io
A member of our security team will then review the report, and get back to you normally within a week. Depending on the criticality of the report, response time will vary.
Triage
We’re always interested in hearing about any reproducible vulnerability that affects the security of users, including:
- Remote Code Execution (RCE)
- SQL Injection (SQLi)
- Server Side Request Forgery (SSRF)
- Cross Site Request Forgery (CSRF)
- Cross Site Scripting (XSS)
We are generally not interested in reports pointing out the following issues:
- HTTP sniffing or HTTP tampering exploits
- Open API endpoints serving public data
- Brute force, DoS, DDoS, phishing, text injection, or social engineering attacks.
- Output from automated scans
- Clickjacking with minimal security implications
- Missing DMARC records
Scope
Currently all appfarm services running on the following domain and subdomains:
- appfarm.io
- *.appfarm.io
Note that potential problems with our sub-processors will be forwarded to the responsible party, for them to evaluate the report.
Reward
We currently do not have any set prices for reports that we receive, but do offer some Appfarm merchandise if we believe that a report provides valuable information for our organization.
