Security
If you have found a vulnerability in this website or in one of our applications, we want to hear about it directly.
Reporting a vulnerability
Email [email protected] with Security in the subject line. Please include what you found, the exact steps to reproduce it, and the impact you believe it has. We will confirm receipt, tell you what we find, and let you know when a fix ships.
Please give us a reasonable period to fix an issue before disclosing it publicly, do not access or modify data that is not yours, and do not run denial-of-service or automated load tests against our systems or against a customer's account.
We do not operate a paid bug bounty. We will credit you by name if you would like that, and we will not pursue a good-faith researcher who follows the guidance above.
How this website is built
- Static files only. There is no server-side application, no database, no user account and no payment processing behind this site.
- No third-party scripts, fonts, embeds or trackers, so there is no third-party code path to compromise.
- HTTPS is enforced, with HTTP Strict Transport Security.
- Responses carry a restrictive content security policy, frame protection, MIME sniffing protection and a strict referrer policy.
- The site is built from a public source tree that contains no credentials; deployment secrets live in the deployment platform, not in the repository.
How our applications are built
- Marketplace applications run on the platform vendor's own infrastructure. We do not operate a server that receives your helpdesk or store data.
- Outbound requests are addressed to your own account on that platform, and to nothing else.
- Credentials are stored as platform-managed secure installation parameters. They are attached to requests by the platform, are not returned to the browser, and are not visible to us.
- Operations that change data require an explicit confirmation, run in bounded batches, and are verified per record.
- We recommend giving an application a credential with the narrowest permissions that let it do its job.
What we do not claim
We hold no security certification, and no third party has audited our code or our infrastructure. This page describes how the software is built; it is not an assurance report, and we will not describe it as one.