Vulnerability disclosure policy

1. Reporting a vulnerability

If you believe you have found a security vulnerability in Riska, email security@riska.io. Please include:

• a description of the issue and its likely impact;
• the steps to reproduce it, including any URLs, requests or proof-of-concept code;
• how you would like to be credited, if at all.

2. Scope

This policy covers riska.io and its subdomains, including the Riska application and API.

The following are out of scope:

• denial-of-service and volumetric attacks;
• social engineering of Riska staff or customers, and physical attacks;
• findings that need a compromised device or browser, or physical access to one;
• reports from automated scanners that come without a demonstrated impact;
• missing best-practice headers or settings that have no demonstrated security impact;
• services run by third parties, which should be reported to that provider.

3. Guidelines

While you research, please:

• use only accounts you own, or that the account owner has allowed you to test;
• stop as soon as you reach data that is not yours, do not keep it, and tell us what you reached;
• avoid any action that could degrade the service for other users, or modify or delete data;
• give us a reasonable time to fix the issue before you disclose it publicly.

4. What you can expect from us

• We will acknowledge your report within three business days.
• We will keep you informed while we investigate and fix the issue.
• We will tell you when it is fixed, and credit you if you would like us to.

5. Safe harbour

If you act in good faith and follow this policy, we will consider your research authorised, we will not take legal action against you over it, and if a third party takes legal action against you over it we will make it known that you acted under this policy.

We do not currently run a paid bug bounty.