Reporting a security problem

Machine-readable version: /.well-known/security.txt

If you have found a vulnerability in Jambrio — a way to reach data that should be private, a gate that opens for the wrong person, anything that would surprise a host or a guest — we would like to hear about it. Email security@jambrio.com.

Tell us what you found, how to reproduce it, and what you think it exposes. A rough note that lets us reproduce the problem is worth more to us than a polished report that does not.

What we promise

• A reply from a person within 5 business days. We are a small team and would rather commit to something we can keep than to twenty-four hours we cannot.
• We will tell you what we did about it, and if we decide not to act, we will tell you that and why.
• Credit if you want it, and no credit if you would rather not be named.
• We do not pay bounties. We would rather say so now than have you find out after the work.

Safe harbor

If you make a good-faith effort to follow the rules below, we will treat your research as authorized. We will not pursue legal action against you, we will not report you, and if someone else does, we will say plainly that you were acting with our permission.

If you are partway through and unsure whether something is in bounds, stop and ask. Asking first is always within the rules.

Rules

• Test against your own accounts and your own events. Make a second account and invite it. Do not test against a gathering that belongs to someone else.
• If you find a leak, report it — do not measure it. Showing that one record is reachable establishes the bug. Enumerating the rest turns a report into the breach it was describing. One clear example is enough, and it is the version we can act on fastest.
• Do not degrade the service. No denial of service, no load testing, no automated scanning heavy enough to affect anyone else.
• Do not keep what you find. If you come across someone else’s data, stop, tell us, and delete your copy.
• Give us a chance to fix it before you publish. Tell us your timeline and we will work to it; we will not ask you to stay quiet indefinitely.
• No social engineering of our people, our users, or our suppliers, and no physical attacks.

Breaking these does not void the safe harbor automatically — we read for good faith, not for technicalities — but it is the difference between a report we act on and one we have to treat as an incident.

Scope

In scope: jambrio.com and its subdomains, and the API behind them.

Out of scope: anything hosted by a third party we merely use, and findings from an automated scanner with no demonstrated impact — a missing header, a cookie flag, a version banner. If you can show it leads somewhere, it is in scope again.

We are also interested in design-level reports, not only implementation bugs. A setting whose answer tells you something about a third party is a finding here even if nothing is technically broken, and our privacy commitments are the standard we would like to be held to.

If it is urgent

If you believe data is being accessed right now, say so in the subject line and we will treat it as an incident rather than a report.