Keeping our customers' data safe is a top priority at Appcircle. If you believe you have found a security vulnerability in an Appcircle service, we encourage you to report it to us privately. We review every report and reward valid findings based on their severity.
How to report
- Email your report to security@appcircle.io. Please do not use support tickets or public channels.
- Include a clear title, the affected service or URL, a description of the vulnerability and its impact, and step-by-step reproduction instructions or a proof of concept.
- Send each vulnerability in a separate email.
- Include the email address where you want to receive your reward.
- Reports containing only automated scanner output are not accepted.
Scope
Any exploitable vulnerability that can compromise the integrity of customer data, disclose sensitive information or disrupt the service on the Appcircle cloud platform (my.appcircle.io and its APIs), for example:
- Remote code execution
- SQL or other injection
- Authentication or authorization bypass, including cross-organization data access
- Cross-site scripting (XSS) and cross-site request forgery (CSRF)
- Exposure of sensitive data such as credentials, signing keys or certificates
Out of scope
- Self-hosted Appcircle installations and the marketing website
- Vulnerabilities in third-party services or software we use
- Missing security headers (HSTS, CSP, X-Frame-Options and similar)
- Missing cookie flags, autocomplete settings or mixed content
- Self-XSS, logout CSRF and CSRF on anonymous forms
- Username or email enumeration, verbose error messages and software version disclosure
- Missing rate limiting or brute force without a demonstrated impact
- Social engineering, phishing and physical attacks
- Denial of service attacks
Rules
- Test only against accounts and data you own. Do not access, modify or delete other users' data.
- Do not degrade the service or run high-volume automated scans.
- Do not disclose the issue publicly or to any third party without our written permission. Unauthorized disclosure makes the report ineligible for a reward.
We will not take legal action against researchers who follow these rules and act in good faith.
How we prioritize reports
Every valid report is scored with the CVSS v3.1 base score, based on the impact the report demonstrates on the Appcircle cloud platform, not on theoretical impact. We act on reports in order of their CVSS score: the higher the score, the sooner the issue is fixed.
Rewards
Rewards are based on the severity set by the CVSS v3.1 score. They are paid through Tremendous, a digital rewards platform: you get an email at the address in your report and choose how to redeem the reward. You do not need to create an account.
- Critical (CVSS 9.0 - 10.0, $200 and a Hall of Fame listing): Full compromise of the platform or of other customers' data, with no user interaction and no special access needed.
- High (CVSS 7.0 - 8.9, $100): Significant cross-tenant or privileged impact that needs some precondition or is limited in scope.
- Medium (CVSS 4.0 - 6.9, $50): Limited impact, typically within the attacker's own organization or dependent on significant user interaction.
- Low (CVSS 0.1 - 3.9, $25): Minimal security impact or hard to exploit in practice.
- Only the first report we receive for a root cause is rewarded, also when different researchers report it, for example on different endpoints. Later reports are duplicates and are not eligible. Issues with different root causes are rewarded separately.
- Functional bugs without a security impact are not eligible. We still thank you for reporting them and pass them to our product team.
- A report must include a working proof of concept on accounts you own. Reports without a demonstrated security impact are not eligible.
- Severity is lowered when an exploit requires unlikely user interaction, an already privileged account or a non-default configuration.
- An exploit chain is rated by its final impact and rewarded once.
- Issues listed as out of scope are not eligible, even when combined with other findings.
- Appcircle determines the final severity and may decline a reward at its discretion.
- Rewards are subject to an annual program budget. Once the budget is used, no further rewards are paid until the next program year.
Hall of Fame
We thank the following researchers for responsibly disclosing Critical security issues to us. Only Critical findings are listed, after the issue is fixed and with the researcher's permission.
No entries yet. Be the first!