How to report
Email security@email.sessional.co.uk with the steps to reproduce the issue, the URL or request involved and what you believe the impact is. A written description is enough; we do not need a video. If you want a reply to a different address, say so.
We acknowledge reports within two working days and tell you when the issue is fixed. The same details are published in machine-readable form at /.well-known/security.txt.
What we ask
- Test only against accounts you own. A free account takes a minute to create; never read, change or delete anyone else's data. If you come across it by accident, stop and tell us.
- No denial of service, no high-volume automated scanning, and no social engineering of our users or of us.
- Give us time to fix the issue before you talk about it publicly. We will agree the timing with you and we do not drag our feet.
What you can expect
- Research done in good faith within these rules is welcome, and we will not take legal action over it.
- We fix what needs fixing, tell you when it is done and, if you would like, credit you here.
- Sessional does not run a bug bounty programme and does not pay for reports. Please do not send a report on the expectation of payment.
In scope
sessional.co.uk, including the signed-in app, the public tools and the REST API; the email domain email.sessional.co.uk; and the links we send to organisations and respondents.
Out of scope
We will read everything, but the following are not treated as security issues:
- Output from automated scanners without a working demonstration of impact.
- Opinions on email configuration. SPF, DKIM and DMARC are set on both of our sending domains.
- Missing headers, cookie flags or clickjacking on pages that hold no account data and offer no action.
- Rate limits, version numbers and error messages, unless you can show what they let you do.
- Services we do not run, such as our payment, email and hosting providers. Report those to them.