GenetixBayEST. 2009
ENFRJoin the waitlist
Menu
Draft: under legal review. Last updated
Security and disclosure · GenetixBay

Found a hole? Tell us first.

If you think you've found a security problem in GenetixBay, we want to hear about it, and we'll work with you to fix it. Here's how to report it safely.

The short version

  • Report to security@genetixbay.com. Include the steps to reproduce it.
  • We aim to reply within 3 business days and keep you updated until it's fixed.
  • Act in good faith and follow these rules, and we won't pursue legal action against you.
  • Give us 90 days to fix it before you go public.

In scope

  • genetixbay.com, genetixbay.ca and their subdomains;
  • the GenetixBay app, once it opens;
  • our emails (for example, spoofing that bypasses our sender checks);
  • Jardin firmware and apps, once they ship.

Services we use, such as Cloudflare or our email provider, have their own programmes; please report problems in them directly to them.

How to report

Email security@genetixbay.com with:

  • what you found and where (the address, page or feature);
  • steps to reproduce it, and a proof of concept if you have one;
  • what an attacker could do with it;
  • how you'd like to be credited, if at all.

[OWNER: publish an encryption key for security reports, if wanted.] Until security@genetixbay.com is switched on, use hello@genetixbay.com with “Security” in the subject.

Rules for testing

  • Use only accounts and data that are yours. Never access, change or delete other people's data; if you reach some by accident, stop and tell us, and don't keep it.
  • No denial-of-service, flooding, spam or anything that degrades the service for others.
  • No social engineering, phishing or physical attacks on our people, offices or equipment.
  • Keep it private until we've fixed it, or for 90 days, whichever comes first, unless we agree otherwise.

What we promise

  • We aim to acknowledge your report within 3 business days, and to keep you updated.
  • We'll tell you when it's fixed, and credit you if you'd like.
  • If you act in good faith and follow these rules, we won't pursue legal action against you, and we'll consider your research authorised. [COUNSEL: safe-harbour wording.]

We don't run a paid bug bounty yet. [OWNER: thank-you reward, if any, such as Pearls or merch.]

Usually out of scope

  • reports from automated scanners without a demonstrated impact;
  • missing security headers or cookie flags with no real-world effect;
  • clickjacking on pages without sensitive actions;
  • rate limits on non-sensitive pages;
  • email-authentication record suggestions (SPF, DKIM, DMARC) without a working spoof.

security.txt

Our machine-readable contact file lives at /.well-known/security.txt.