Security and vulnerability disclosure

Email security@grandpoint.uk with a description of the problem, the steps to reproduce it, the URL or feature affected, and what an attacker could achieve. Screenshots or a short proof of concept help. Please do not include anyone else’s personal data in the report.

• An acknowledgement within 3 working days.
• An initial assessment, and our plan, within 10 working days.
• Updates while we fix it, and word when it is fixed.
• Credit, if you would like it, once the issue is resolved. We do not currently run a paid bug bounty.

• Test only with accounts and workspaces you own or have permission to use.
• Stop as soon as you reach data that is not yours, do not keep or share it, and tell us what you saw.
• Do not change or delete data, degrade the service, or send large volumes of requests.
• Give us a reasonable time to fix the issue before telling anyone else (we aim for 90 days or less).

• Denial-of-service and load testing; spam or social engineering of our staff or customers.
• Physical attacks; attacks on third-party services we use (report those to the provider).
• Findings with no security impact, such as missing headers on pages without sensitive content, or version banners.
• Problems that need a compromised device or browser, or an already-stolen session.

If you act in good faith and follow this policy, we will not take legal action against you or ask others to, and we will treat your research as authorised under it. This does not cover access to other people’s data beyond what is needed to show the problem, and it cannot authorise anything that breaks the law.