Reporting a security problem

Ordinary bugs

If something in the app does not work as it should, check Known issues first, then use Report a problem in the app. This page is only for problems that could let someone see, change or delete data they should not reach.

How to report

Email security@slreviewflow.com with the subject “Security report”. Please include:

• what the problem is and what someone could do with it;
• the steps to reproduce it, with the pages or requests involved;
• the accounts you used, which must be your own test accounts.

Please do not report security problems through Report a problem, social media or any public channel, and do not share them with anyone else until we have fixed them.

In scope

• The SLReviewFlow web application at www.slreviewflow.com, including its public pages.
• The SLReviewFlow PDF Sender browser extension.
• Account emails sent from slreviewflow.com.

Out of scope

• Services we use but do not run, such as our hosting, database, email and error-monitoring providers. Report those to the provider.
• Reports from automated scanners with no demonstrated impact, missing best-practice headers without a working attack, and self-XSS.
• Denial of service, spam, social engineering of our team or users, and physical attacks.

Rules for testing

• Use only accounts and projects you created. Never open, change or delete anyone else's data; if you reach it by accident, stop, do not keep a copy, and tell us.
• Do not run load tests, flood forms or send large numbers of automated requests.
• Do not upload malware or content that is unlawful or that you do not have the right to share.
• Give us reasonable time to fix the problem before you talk about it publicly; we will agree a date with you.

What we promise

We will confirm we received your report within 3 working days, tell you whether we can reproduce it, and keep you informed until it is fixed. If you follow this policy in good faith, we will not take legal action against you or ask anyone else to, and we will treat your research as authorised.

We do not pay rewards. With your permission, we will thank you by name on this page once the fix is live.