Dropwarden

Legal and security documents

DRAFT — requires lawyer review. Not legal advice.

Dropwarden Responsible Disclosure Policy

Last updated: TBD

We welcome reports from security researchers. If you believe you have found a vulnerability in Dropwarden, please tell us so we can fix it before it can be misused.

How to report

  • Email [email protected]. If you want to encrypt your report, use the key at https://dropwarden.com/.well-known/pgp-key.txt.
  • Include: the affected host or URL, a description of the issue and its impact, steps to reproduce, any proof-of-concept, and how we can contact you.
  • Please do not report through the chat widget or social media.

Our machine-readable contact details are at https://dropwarden.com/.well-known/security.txt.

Scope

In scope:

  • dropwarden.com (website)
  • app.dropwarden.com (portal and web file client)
  • api.dropwarden.com (API and sign-in)
  • sftp.dropwarden.com (SFTP on port 22 and FTPS)

Out of scope:

  • denial-of-service or load testing, spam, and social engineering of staff or customers;
  • physical attacks;
  • third-party services we use (for example Stripe, Crisp, Cloudflare, Oracle Cloud, Amazon SES). Report those to the vendor;
  • customer-owned systems, including customer custom domains and webhook endpoints;
  • reports from automated scanners without a demonstrated impact, missing security headers or best practices without a concrete exploit, and self-XSS;
  • vulnerabilities that require a compromised device or an outdated, unsupported browser.

Rules for testing

  • Create your own free trial organization and test only against accounts and data you own. Never access, change or delete another customer's data. If you reach data that is not yours, stop immediately, do not keep copies, and tell us in your report.
  • Do not degrade the Service for others: no denial-of-service, no high-volume automated scanning, no brute-forcing of other people's credentials.
  • Do not upload real malware. Use the EICAR test file if you need to test malware scanning.
  • Keep the details confidential until we have fixed the issue and agreed a disclosure date with you.

What you can expect from us

  • Acknowledgement within 3 business days.
  • An initial assessment within 10 business days, and updates at least every 14 days until the issue is resolved.
  • We aim to fix critical issues within 30 days and coordinate public disclosure with you, normally within 90 days of your report.
  • With your permission, we will credit you in our acknowledgements.
  • We do not currently run a paid bug bounty.

Safe harbor

If you make a good-faith effort to follow this policy, we will consider your research authorized, will not pursue or support legal action against you for it, and will not report you to law enforcement. If a third party brings legal action against you for activities that followed this policy, we will make it known that your actions were authorized by us. This does not authorize you to breach any law or to access data that is not yours. If in doubt, ask us at [email protected] before you proceed.

Acknowledgments

We thank the following researchers for responsibly disclosing issues (with their permission):

  • None yet.