Vulnerability Disclosure

Customer enquiries

Customers requesting information about a newly identified vulnerability, or its potential impact on Siteimprove services, should contact infosec@siteimprove.com.

Responsible disclosure of vulnerabilities

Siteimprove recognises the important role independent security researchers play in protecting internet services. We encourage responsible disclosure of suspected vulnerabilities affecting Siteimprove websites or applications and will work with researchers to verify and address valid reports. Please:

1. Review the independent security research guidelines below
2. Privately share details of the suspected vulnerability with Siteimprove by sending an email to security@siteimprove.com
3. Provide full details of the suspected vulnerability so the Siteimprove security team can reproduce and validate the issue.

After receiving a vulnerability report, Siteimprove commits to:

• Respond in a timely manner, acknowledging receipt of your vulnerability report
• Assess and prioritise the reported issue based on its validity, severity and potential impact
• Take appropriate remediation action when the report identifies a valid vulnerability

Independent security research guidelines

Independent security research is authorised only for the domains and subdomains listed below:

• my.siteimprove.com
• my2.siteimprove.com
• id.siteimprove.com
• sso2.siteimprove.com
• www.siteimprove.com

All other Siteimprove-related domains and subdomains are out of scope and must not be tested.

The following activities are expressly prohibited during security research:

• Performing actions that may negatively affect Siteimprove or its users (e.g. spam, brute-force attacks, denial of service)
• Accessing, or attempting to access, data or information that does not belong to you
• Destroying or corrupting, or attempting to destroy or corrupt, data or information that does not belong to you
• Conducting any kind of physical or electronic attack on Siteimprove personnel, property or data centres
• Social engineering any Siteimprove service desk, employee or contractor
• Violating any laws or breaching any agreements in order to discover vulnerabilities
• Testing any domain or subdomain not listed above

Acknowledgement

Siteimprove does not offer financial compensation for reported vulnerabilities. We thank the following individuals for responsibly reporting security issues affecting our online services.

• Mohammed Israil (@mdisrail2468)
• Jens Müller (@jensvoid)
• Remesh Ramachandran (www.remeshr.com)
• Dava Wardana (linkedin.com/in/dava-wardana140502)