Responsible disclosure
If you have found something, we want to hear from you.
ClaimCore holds medical reports, bank details and signed agreements. A vulnerability in it matters, and a report is more useful to us than it is uncomfortable.
How to report
Use the contact page and mark the message as a security report. It reaches a monitored queue rather than an inbox.
Please include how you would like to be credited, or tell us if you would rather not be.
What we commit to
We will acknowledge you
Within three working days, by a person rather than an autoresponder.
We will investigate and tell you what we found
Including when we disagree that it is a vulnerability, and why. A report dismissed without explanation is a researcher who does not come back.
We will not take legal action
Against anybody acting in good faith under this policy, who stops at the point of demonstrating an issue and does not access, alter or retain anybody else’s data.
We will credit you if you want it
Once the issue is resolved. There is no paid bounty programme — we would rather say so than imply one.
What we ask
Test against your own account or against the demonstration environment. Do not access, modify or retain data belonging to anybody else — if you can demonstrate an issue without doing so, please stop there and tell us.
No denial of service, no social engineering of our people or our customers, and no physical testing. Please give us a reasonable period to fix an issue before disclosing it publicly.
Out of scope: missing security headers with no demonstrated impact, reports produced solely by an automated scanner, rate-limiting on unauthenticated endpoints, and issues in third-party services we do not control. Tell us anyway if you think we are wrong about one of those.
Being straight about scale
ClaimCore is a small operation. We will not always fix something in days, and we will tell you honestly when a fix is going to take longer and why. What we will not do is go quiet.