If you think you have found a security problem in Fondaro, we want to hear about it and fix it. This page explains how to tell us and what to expect.
How to Report
Email security@fondaro.com. Please include:
- What you found and where, with the address or screen involved
- The steps to reproduce it, and anything that helps us see it, such as screenshots or requests
- What you think the impact is
- How we can reach you
Scope
This policy covers www.fondaro.com, api.fondaro.com and the Fondaro mobile apps.
Ground Rules
When you test, please:
- Use only your own accounts and data
- Do not disrupt the service. No denial of service, and no load that affects other users
- Do not use social engineering, phishing or physical attacks against our people or offices
- If you reach someone else's data, stop, and report it to us straight away without copying or keeping it
- Give us reasonable time to fix the problem before you tell anyone else about it
What We Do
- We aim to reply within 5 working days.
- We keep you posted while we investigate and fix it.
- We will not pursue legal action against good-faith research that follows this policy.
Rewards
We do not run a paid bounty. We are glad to thank you by name once the problem is fixed, if you would like that.