Details

We believe that working with experienced security researchers across the globe is fundamental to identifying weaknesses in our technology and essential for keeping our products and our users safe.

If you believe you've found a security issue in one of our products or services, we kindly ask you to notify us. We welcome working with you to resolve the issue promptly.

Domains, applications and properties in scope

Web applications

moviecontentfilter.com (including any subdomains)
briefe.io (including any subdomains)
delight.im (including www subdomain)

Android apps

im.delight.letters (Android)

Inclusions – Findings that are in scope

Remote-code execution (RCE)
SQL injection
Authentication bypass
Leakage of sensitive data
Privilege escalation
Improper access control
Cross-site scripting (XSS)
Server-side request forgery (SSRF)
etc.

Disclosure Policy

Let us know about potential security issues as soon as possible upon discovery, and we'll make every effort to resolve the issue quickly and adequately.
Please provide us with a reasonable amount of time to resolve the issue before any disclosure to the public or to any third parties.
Please strive to avoid privacy violations, destruction of data, and interruption or degradation of our service. Only interact with accounts that you own or with accounts where you have the explicit permission of the account holder.
Include proofs of exploitability, e.g. steps to reproduce, screenshots, images, video or scripts.
Minimize the damage that occurs during your research. Use and operate on test accounts only and test "safe" commands such as hostname, uname, id, cat /proc/1/maps or touch /root/your_username.
Describe the environment that you found a weakness in, e.g. URL, application, browser (vendor and version number) and operating system (vendor and version number).
Reported bugs will be assessed by our security team to determine if they qualify for a reward. We will consider the impact to the company and our users and will calculate the reward accordingly.
You will be eligible for a bounty only if you are the first person to disclose an unknown issue to us.
The more thorough the proof-of-concept, the higher the chance a payout will be awarded.
Do not interrupt our services, destroy any data, compromise other users' accounts or commit privacy violations.

Exclusions – Findings that are out of scope

While researching and also when it's time to report a potential vulnerability, we'd like to ask you to refrain from performing any of the following activities or attacks:

Denial of service (DoS or DDoS) attacks
Social engineering (e.g. phishing) of our staff or contractors
Physical attempts against our property or data centers
Vulnerabilities affecting outdated browsers or platforms
Spamming
Missing security-related HTTP headers which do not directly lead to vulnerabilities
SSL/TLS best practices
CSRF
Clickjacking
Results of automated tools or scanners
Brute-force attacks
Incomplete or missing SPF, DKIM or DNSSec
Weak password policy
Presence of “autocomplete” attributes in forms
Self-XSS

Legal

You are expected to comply with all applicable laws in connection with your participation in this program.
You are responsible for the payment of any taxes associated with rewards received.
We may modify the terms of this program or terminate the program at any time.

Thanks

Thank you for helping keep delight.im and our users safe!

Disclosure Policy

Let us know about potential security issues as soon as possible upon discovery, and we'll make every effort to resolve the issue quickly and adequately.

Please provide us with a reasonable amount of time to resolve the issue before any disclosure to the public or to any third parties.

Please strive to avoid privacy violations, destruction of data, and interruption or degradation of our service. Only interact with accounts that you own or with accounts where you have the explicit permission of the account holder.

Include proofs of exploitability, e.g. steps to reproduce, screenshots, images, video or scripts.

Minimize the damage that occurs during your research. Use and operate on test accounts only and test "safe" commands such as hostname, uname, id, cat /proc/1/maps or touch /root/your_username.

Describe the environment that you found a weakness in, e.g. URL, application, browser (vendor and version number) and operating system (vendor and version number).

Reported bugs will be assessed by our security team to determine if they qualify for a reward. We will consider the impact to the company and our users and will calculate the reward accordingly.

You will be eligible for a bounty only if you are the first person to disclose an unknown issue to us.

The more thorough the proof-of-concept, the higher the chance a payout will be awarded.

Do not interrupt our services, destroy any data, compromise other users' accounts or commit privacy violations.

Exclusions – Findings that are out of scope

While researching and also when it's time to report a potential vulnerability, we'd like to ask you to refrain from performing any of the following activities or attacks:

Denial of service (DoS or DDoS) attacks

Social engineering (e.g. phishing) of our staff or contractors

Physical attempts against our property or data centers

Vulnerabilities affecting outdated browsers or platforms

Spamming

Missing security-related HTTP headers which do not directly lead to vulnerabilities

SSL/TLS best practices

CSRF

Clickjacking

Results of automated tools or scanners

Brute-force attacks

Incomplete or missing SPF, DKIM or DNSSec

Weak password policy

Presence of “autocomplete” attributes in forms

Self-XSS