Details

Factlink is an open-source community project for annotating the world's information. If you have discovered a security issue that you believe we should know about, we'd welcome working with you.

Scope

Please report serious vulnerabilities in our website (https://staging.factlink.com), proxy (https://staging.fct.li), or other components (our annotation library, Wordpress plugin, browser extensions, and gems).

Please only use our staging environments for testing, they are otherwise identical to production.

For an extra big thanks, help us by making a pull request to fix the problem. All our code can be found at https://github.com/Factlink.

Eligibility and Disclosure

In order for your submission to be eligible:

You must agree to our Vulnerability Disclosure Policy.
You must be the first person to responsibly disclose an unknown issue.
All legitimate reports will be reviewed and assessed by Factlink's team to determine if it is eligible.

Out of scope

Server infrastructure. We run on Heroku with CloudFlare in front of it. Please report problems with their infrastructure to them.
Denial of Service and Social Engineering attacks.
Physical attacks against Factlink employees, offices, and data centers.
Social engineering of Factlink employees, contractors, vendors, or service providers.
Knowingly posting, transmitting, uploading, linking to, or sending any malware.
Pursuing vulnerabilities which send unsolicited bulk messages (spam) or unauthorized messages.
Any vulnerability obtained through the compromise of a Factlink customer or employee accounts. If you need to test a vulnerability, please create an account.

Rewards

We believe in recognising the work of others. If your work helps us improve the security of our service, we'd be happy to acknowledge your contribution in our Hall of Fame.

Factlink is an open source product and we strive to disclose all valid reports.

Thanks for contributing to making everything on the web discussable, and curbing misinformation!

Thanks

Thanks to HackerOne for providing this service, and to 4chan and CloudFlare for creating templates to work from. We look forward to hearing from you.

Scope

Please only use our staging environments for testing, they are otherwise identical to production.

For an extra big thanks, help us by making a pull request to fix the problem. All our code can be found at https://github.com/Factlink.

Out of scope

Server infrastructure. We run on Heroku with CloudFlare in front of it. Please report problems with their infrastructure to them.

Denial of Service and Social Engineering attacks.

Physical attacks against Factlink employees, offices, and data centers.

Social engineering of Factlink employees, contractors, vendors, or service providers.

Knowingly posting, transmitting, uploading, linking to, or sending any malware.

Pursuing vulnerabilities which send unsolicited bulk messages (spam) or unauthorized messages.

Any vulnerability obtained through the compromise of a Factlink customer or employee accounts. If you need to test a vulnerability, please create an account.

Rewards

We believe in recognising the work of others. If your work helps us improve the security of our service, we'd be happy to acknowledge your contribution in our Hall of Fame.

Factlink is an open source product and we strive to disclose all valid reports.

Thanks for contributing to making everything on the web discussable, and curbing misinformation!