From 0bcd45babe1df6b5193af6059753d5cec3a351a6 Mon Sep 17 00:00:00 2001 From: Kevin Papst Date: Mon, 5 Aug 2024 13:23:53 +0200 Subject: [PATCH] clarify test exclusions --- SECURITY.md | 26 ++++++++++++++++++++++---- 1 file changed, 22 insertions(+), 4 deletions(-) diff --git a/SECURITY.md b/SECURITY.md index 0ea92ede..a2658f9e 100644 --- a/SECURITY.md +++ b/SECURITY.md @@ -1,7 +1,5 @@ # Security Policy -## Supported Versions - As announced in the [README](README.md) I only support the latest available release and `main` branch. | Version | Supported | @@ -21,7 +19,27 @@ Depending on the size of the required fixes, this might take a couple of hours o You can expect that your message will be answered ASAP. -You will be mentioned in the release notes if your issue is valid. +Make a good faith effort to avoid privacy violations, destruction of data, and interruption or degradation of our service. +Only interact with accounts you own or with explicit permission of the account holder. + +## Exclusions + +While researching, please refrain from: + +- Denial of service +- Spamming +- Social engineering (including phishing) + +YOU MAY NOT TEST AGAINST SERVERS (e.g. Kimai-Cloud, Demo) YOU DO NOT HAVE EXPLICIT PERMISSION TO TEST. + +There are official laws in the EU, that force the owner of a service to report any attack to the authorities. + +## Reward + +You will be mentioned in the release notes if your issue is valid. + I am grateful for any (discrete) disclosure of vulnerabilities! -Please note: if you are asking for money, I will not reply. I receive these scam messages every day... +## Bug bounty + +Please note: if you are asking for money, I will not reply. I receive too many of these scam messages every day.