Reporting a security problem
Never test against a customer's site. SiteSelf works on websites other people own. Test only against your own account and a WordPress site you control.
How to report
Write to dev@refact.co with “Security” in the subject. Say what you found, how to reproduce it, and what you think its impact is. We aim to acknowledge a report within five working days and to keep you told what we decide. We do not pay bounties.
In scope
- siteself.com, including the dashboard
- api.siteself.com and admin.siteself.com
- SiteSelf Connector, the WordPress plugin
- The separation between one customer's agent and another's
Out of scope, and not permitted
- Any site connected to SiteSelf that is not your own
- Denial of service, or any test that degrades the service for others
- Social engineering or phishing of our team or customers
- Physical attacks
- The services we use, such as Stripe, Slack or Telegram. Report to them directly
Rules for testing
- Use your own account, and your own WordPress site.
- If you reach data that is not yours, stop, do not keep or share it, and tell us what you reached.
- Give us reasonable time to fix a problem before you disclose it, normally 90 days.
Safe harbour
If you follow this policy in good faith:
- we consider your research authorised, and will not bring a claim under anti-hacking laws;
- we will not bring a claim for getting around technical protections as part of that research;
- we waive the parts of our terms and acceptable use policy that would forbid it;
- we treat your research as done in good faith, and say so if anyone else asks.
If you are unsure whether something is allowed, ask us first at the address above.