Reporting a security vulnerability

Machine-readable: /.well-known/security.txt

Reporting a vulnerability

Email security@divvent.co.uk. Tell us what you found, where, and how to reproduce it. One report per issue is easiest for us to track.

We reply within three working days to say we have it, and tell you what we are doing about it within ten. We will keep you told until it is fixed, and credit you when we publish the fix if you would like to be named.

In scope

divvent.co.uk and app.divvent.co.uk (the site and the customer portal), and the platform that builds and deploys customer applications.

A customer application built on Divvent runs in a hosting account Divvent holds for that customer alone. A flaw in the platform code every application shares is in scope; a customer’s own configuration of their application is theirs, and we will pass a report on to them.

Please do not

Access, change or delete data that is not yours; if you reach some, stop, and tell us what you saw. Degrade the service for others (no denial-of-service testing, no automated scanning at volume). Use social engineering, phishing or physical attacks. Test against a customer’s application without that customer’s permission.

Safe harbour

If you act in good faith and within this policy, we will not pursue or support legal action against you for your research, and we will say so to anyone who asks. This is a draft for review by a solicitor under the law of England and Wales.

Rewards

We do not run a paid bounty programme yet. We will say so here when we do.