Respondly is committed to working with security experts to stay up to date with the latest security techniques. If you have discovered a security issue that you believe we should know about, we'd welcome working with you. Please let us know about it and we'll make every effort to quickly correct the issue.

Automated testing is not permitted

THANKS

We believe in recognizing the work of others. If your work helps us improve the security of our service, we'd be happy to acknowledge your contribution in our Hall of Fame.

Responsible Disclosure Policy

If you give us a reasonable time to respond to your report before making any information public and make a good faith effort to avoid privacy violations, destruction of data and interruption or degradation of our service during your research, we will not bring any lawsuit against you or ask law enforcement to investigate you.

NOTES:

• Report a bug that could compromise the integrity or circumvent the privacy protections of Respondly user data, or enable access to a system within the Respondly infrastructure, such as:
• Cross-Site Scripting (XSS)
• Cross-Site Request Forgery (CSRF/XSRF)
• Broken Authentication
• Remote Code Execution
• Privilege Escalation
• Please only test with your own team when investigating bugs. Automated testing is not permitted
• Do not interact with other accounts without the consent of their owners
• Please focus on respond.ly and our app at app.respond.ly
• Our app is built with MeteorJS, and runs on top of a modern version of NodeJS on Ubuntu servers.
• We philosophically agree with HackerOne's guidelines/philosophy here: https://hackerone.com/guidelines