how to contact you, and whether you want public credit.
Please do not include other people's personal data. If you encounter any, tell us and delete it.
What we do:
acknowledge your report within [3 business days];
keep you informed while we investigate and fix;
tell you when the fix ships; and
credit you if you want, once it is fixed.
3. Safe harbour
If you make a good-faith effort to follow this policy, we consider your research authorised. We will not bring or
support legal action against you for it, including under anti-hacking or anti-circumvention laws. The rules:
Test only against your own organization and devices. Never access, change or delete another organization's data.
Access only the minimum data needed to show the issue, then stop.
No denial-of-service, spam, physical attacks, or social engineering of our staff or customers.
Do not run automated scanning at a volume that degrades the service.
Give us reasonable time to fix the issue before you disclose it: [90 days] from your report, or sooner by agreement.
Do not demand payment in exchange for not disclosing.