Vulnerability disclosure policy

In scope

• The website www.mondaily.com and its pages.
• The Mondaily app at app.mondaily.com, including sign in, your workspace and its data, and the API.

Examples we want to hear about: one account seeing another account's data, a way around sign in or two step sign in, a connection token shown in full, or Mondaily posting or sending something nobody approved.

Out of scope

• Other people's accounts and data: test only your own.
• Services we use but do not run, such as our hosting, email and payment providers. Report those to them.
• Denial of service, load tests, spam, and social engineering or phishing of our people or users.
• Physical access to offices or devices.
• Reports from automated scanners with no shown impact, missing best-practice headers on pages without sensitive data, and self-XSS.

Good-faith research

If you follow this policy, we treat your research as authorised. We will not take legal action against you or report you to the police for it, and we will not ask anyone else to. If someone else brings a claim about research you did under this policy, we will say that it was authorised.

In return, please:

• use only your own accounts and your own data;
• stop as soon as you reach data that is not yours, do not keep or share it, and tell us;
• do nothing that slows the service down or changes or deletes data that is not yours;
• keep the problem private until it is fixed, or until 90 days after your report, whichever comes first, unless we agree another date with you.

If you are unsure whether something is allowed, ask us first at the address below.

How to report

Email security@mondaily.com.

Tell us what you found, where, the steps to reproduce it and what an attacker could do with it. Please do not post a security problem in public.

What happens next

• Within 3 working days: a reply from a person, saying we received your report.
• Within 10 working days: our first assessment, whether we could reproduce it and how serious we think it is.
• At least every 14 days: an update until the problem is fixed or we decide it is not one, with our reasons.
• When it is fixed, we tell you, and we agree with you when and how it is made public.

Thanks and credit

We thank every reporter, and with your permission we credit you by name or handle when the fix is announced. We do not pay rewards today; paid rewards may come later, and this page will say so when they do.

The short version, with the same address: Report a security problem.

Our machine-readable contact file is at www.mondaily.com/.well-known/security.txt.