Security
Found a flaw? Report it, and we will work with you.
Good-faith research is welcome. Report it here or by email, and we will handle it under our published vulnerability disclosure policy.
At a glance
What to expect.
-
Receipt confirmed
Within five business days
-
Good-faith research
Treated as authorized, no legal action
-
Credit
In the name you choose
Report a vulnerability
Before you report.
-
In scope
expandware.com and expandware.us, their subdomains, and the services they run on, from the contact form to the assistant.
Full scope -
What we ask
Test only against your own data, do not degrade the service, and give us a reasonable opportunity to respond before you publish.
The policy -
What we commit to
Receipt within five business days, an honest assessment, progress until it is resolved, and credit if you want it.
Our commitments -
What we do not offer
There is no bug bounty and no monetary reward. We would rather say so plainly.
Other routes
Not quite what you need?
CONTACT
Researchers are treated as allies here.
Good-faith research is welcome. The vulnerability disclosure policy says what is in scope, what we ask of you, and what we commit to in return.
- No legal action for good-faith research
- Receipt confirmed within five business days
- Credit, in the name you choose
What happens next
-
Acknowledged
We confirm receipt within five business days, as the policy commits.
-
Triaged
An engineer reproduces it and agrees the severity with you.
-
Fixed
We tell you when it is fixed, and work to your disclosure timetable.