At Blue Canvas, security is our highest priority. We protect your data and help you meet the challenge of managing distributed teams and their content. Security was built into our design. Our powerful solutions help you stay secure and compliant so you can better protect your organization. See why high tech startups and enterprise businesses trust us with code that matters.
Our responsible disclosure policy promotes the discovery and reporting of security vulnerabilities. If you are a security researcher and have discovered a security vulnerability in our services, we appreciate your help in disclosing it to us in a collaborative manner.
Report any potential security bugs and vulnerabilities to us via email to security@bluecanvas.io
Give us reasonable time to respond before making any information about the security issue public.
Do not access or modify user data without permission of the account owner.
Act in good faith not to degrade the performance of our services (including denial of service).
Blue Canvas will not sue you or ask law enforcement to investigate if you comply with these instructions.
Our Commitment to Security Researchers
When working with us according to this policy, you can expect us to:
Extend Safe Harbor for your vulnerability research that is related to this policy;
Work with you to understand and validate your report, including a timely initial response to the submission;
Work to remediate discovered vulnerabilities in a timely manner; and
Recognize your contribution to improving our security if you are the first to report a unique vulnerability, and your report triggers a code or configuration change.
Scope
This is a list of assets for which the organization is explicitly allowing and encouraging good-faith security research:
*.my.bluecanvas.io (the Blue Canvas web application)
tools.bluecanvas.io (free tools from Blue Canvas)
Other publicly reachable endpoints on bluecanvas.io subdomains, if they have an A DNSRR, are also in scope.
Out-of-Scope
Any third-party hosted service on CNAME subdomains, e.g. status.bluecanvas.io (StatusPage)
Disclosure of known public files or directories, e.g. robots.txt
SPF, DKIM, or DMARC configuration suggestions
Denial-of-service vulnerabilities
Login/logout CSRF
Rewards
Blue Canvas does not offer financial compensation. Researchers who reported valid, unique issues will be listed on this page in our Hall of Fame.
Coordinated Disclosure
A researcher can share details of the vulnerability after a fix has been applied and the program owner has provided permission to disclose, or after 90 days from submission, whichever is sooner.
Ground Rules for Security Researchers
To encourage vulnerability research and to avoid any confusion between good-faith hacking and malicious attack, we ask that you:
Play by the rules. This includes following this policy, as well as any other relevant agreements. If there is any inconsistency between this policy and any other relevant terms, the terms of this policy will prevail;
Report any vulnerability you’ve discovered promptly;
Avoid violating the privacy of others, disrupting our systems, destroying data, and/or harming user experience;
Use only the Official Channels to discuss vulnerability information with us;
Keep the details of any discovered vulnerabilities confidential until they are fixed, according to the Disclosure Policy;
Perform testing only on in-scope systems, and respect systems and activities which are out-of-scope;
If a vulnerability provides unintended access to data: Limit the amount of data you access to the minimum required for effectively demonstrating a Proof of Concept; and cease testing and submit a report immediately if you encounter any user data during testing, such as Personally Identifiable Information (PII), Personal Healthcare Information (PHI), credit card data, or proprietary information;
You should only interact with test accounts you own or with explicit permission from the account holder; and
Do not engage in extortion.
Safe Harbor
When conducting vulnerability research according to this policy, we consider this research to be:
Authorized in accordance with the Computer Fraud and Abuse Act (CFAA) (and/or similar state laws), and we will not initiate or support legal action against you for accidental, good faith violations of this policy;
Exempt from the Digital Millennium Copyright Act (DMCA), and we will not bring a claim against you for circumvention of technology controls;
Exempt from restrictions in our Terms & Conditions that would interfere with conducting security research, and we waive those restrictions on a limited basis for work done under this policy; and
Lawful, helpful to the overall security of the Internet, and conducted in good faith.
You are expected, as always, to comply with all applicable laws.
If at any time you have concerns or are uncertain whether your security research is consistent with this policy, please submit a report through one of our Official Channels before going any further.
