Reporting a security problem
If you think you have found a weakness in Hivenza, we want to hear about it. This page says what you can test, how to tell us, and what you can expect from us in return.
What you can test
- The website and the app at hivenza.com, and the API they use.
- Hivenza's mobile apps and browser extension.
- The website chat that Hivenza's customers put on their own sites, the help centres and the request forms Hivenza serves.
- Sign-in, single sign-on, two-step sign-in, invitations and anything that decides who can see what.
Please don't
- Reach, change or delete data that isn't yours. Use your own accounts and workspaces; make a second one to test what one workspace can see of another.
- Slow the service down or stop it (no denial of service, no load or flood tests), or send spam through it.
- Test the social networks, payment providers or other companies we connect to. Report their problems to them.
- Trick or pressure our team or customers, or test our offices or devices.
- Run automated scanners at full speed. Reports of a missing header or a version number without a way to misuse it are noted but rarely acted on.
How to report
Write to hello@hivenza.com with "Security" in the subject. Write in English or French.
hello@hivenza.comWhat helps us most
- What you found and what someone could do with it.
- The steps to see it again: addresses, the requests sent, the account roles used.
- Screenshots or a short recording if they help.
- Whether you saw anyone else's data, and what you did with it.
- How you would like to be credited, if at all.
What we promise
- We confirm we have your report within 3 business days.
- We tell you within 10 business days whether we can see the problem, how serious we think it is and what happens next.
- We keep you informed at least every 14 days until it is fixed, and tell you when it is.
- We aim to fix critical problems within 7 days, serious ones within 30 days and the others within 90 days. If one takes longer, we tell you why.
- If a problem put customers' data at risk, we tell the customers affected, as our data processing agreement requires.
Testing in good faith
If you follow this policy, report what you find to us first and give us a reasonable time to fix it, Versity Life Co-Ltd will not take legal action against you or ask anyone else to, for that testing. If you reach other people's data by accident, stop, don't keep or share it, and tell us in your report. If you are not sure whether something is allowed, ask us first.
Telling others
Please keep the problem between us until it is fixed, or for 90 days after your report, whichever comes first. We are glad to agree a date with you and to read what you plan to publish beforehand. Once it is fixed, we say so publicly when customers need to act.
Thanks
Hivenza doesn't pay rewards for reports at the moment. With your permission, we name you as the person who found the problem when we write about the fix.