Security
Found a vulnerability in CrowOn? How to report it, and what we promise.
Scope
crowon.app, support.crowon.app, the CrowOn iPhone app, and the CrowOn server they use (/api).
- Out of scope: accessing other people's accounts or data, denial of service, sending spam, social engineering, physical attacks, and services run by companies other than CrowOn.
How to report
Use the form below. Steps to reproduce, the impact, and when and where you tested help us check it quickly.
- Test only with accounts you created yourself.
- If you come across someone else's data, stop, don't keep it, and report it right away.
- Please don't publish details until it's fixed.
Safe harbour
For research and reports made in good faith and within the rules on this page, CrowOn will not take legal action or file a complaint with law enforcement. If you're unsure whether something is within the rules, ask through the form before you start.
What we promise
- We read every report and reply.
- We tell you what we found and when we plan to fix it.
- We let you know when it's fixed, and can thank you by name if you'd like.
- There is no bounty programme at the moment.