Report a vulnerability

1. What this policy covers

This policy covers:

• structivy.com
• platform.structivy.com
• admin.structivy.com
• login.structivy.com

2. How to report

Send your report to security@tremoot.com. Describe:

• which vulnerability you found and where;
• the steps to reproduce it;
• its possible impact;
• how we can reach you.

Do not share the vulnerability with others until it has been fixed. Our reporting address is also listed in /.well-known/security.txt.

3. What we ask of you

• Do no more than needed to demonstrate the vulnerability.
• Do not view, change or delete other people's data. If you come across personal data, stop and report it.
• Do not use social engineering, physical attacks or attacks on availability, such as a denial-of-service attack.
• Do not use automated scanners that generate a lot of traffic.

4. What you can expect from us

Your report goes to our Security Officer, who assesses it, coordinates how it is handled and is your point of contact. We treat your report confidentially.

5. What this policy does not cover

• reports without a demonstrable security risk, such as a missing header or visible version information that cannot be exploited;
• attacks on availability, such as a denial-of-service attack;
• social engineering and physical attacks;
• systems of other parties, such as Microsoft. Report a vulnerability in those to that party directly.

6. Reward

We have no reward programme (bug bounty) and pay no fee for reports.