Vulnerability disclosure policy

How to report a security problem in Docnez, and what we promise in return.

Last updated:

How to report

Email hello@docnez.com with "Security" in the subject. Include the affected URL, steps to reproduce and the impact you expect. Please do not include other people's personal data. We will acknowledge your report within 3 business days and keep you updated until it is resolved.

Scope

In scope: docnez.com, app.docnez.com and the Docnez web app, including signing links, the Verify page and the PDF editor.

Out of scope: denial-of-service or load testing; social engineering or phishing of our staff or users; physical attacks; spam or email-sending tests; findings in third-party services we use (report those to the provider); reports from automated scanners without a working proof of concept; missing best-practice headers or settings with no demonstrated security impact.

Rules for testing

  • Use only accounts you create yourself. Do not access, change or delete data that is not yours. If you reach other people's data by accident, stop, do not keep it, and tell us.
  • Do not degrade the service for other users. Keep automated requests to a gentle rate.
  • Give us a reasonable time to fix the issue (we aim for 90 days) before you disclose it publicly.

Safe harbor

If you make a good-faith effort to follow this policy, we will consider your research authorised, we will not pursue or support legal action against you for it, and we will work with you to understand and fix the problem quickly. If a third party brings legal action over activity that followed this policy, we will make it known that your actions were authorised by us. This does not authorise testing of systems that are not ours.

No bounty

Docnez does not run a paid bug bounty. We are happy to thank you publicly, with your permission, once the issue is fixed.