Found a security issue? Tell us first
Send us an encrypted report and give us time to fix it. We reply within five business days, keep you posted, credit you if you like, and reward every non-trivial issue we didn’t know about.
How to report an issue
Report anything that could affect the security of Staatic, our customers’ sites or their data, as soon as you find it.
-
Encrypt it with our PGP key
Use the key beside these steps. We only consider reports encrypted with PGP, so the details stay between you and us.
-
Include what we need to reproduce it
The URL or IP address of the affected system, the steps that trigger the issue and what an attacker could do with it. Complex issues may need a longer explanation.
-
Send it to cert@staatic.com
In English or Dutch. Then keep the issue to yourself until it’s fixed.
While you test
Show the issue, not its damage. These rules protect our customers, and they’re what our promises below depend on.
Don’t exploit the issue beyond what you need to show it. Don’t copy more data than needed, and never change or delete other people’s data.
No social engineering, physical attempts, denial of service, spam, or attacks through third-party applications.
Don’t create large numbers of accounts, or large amounts of content or other data, that could affect our services or their data.
Keep the issue confidential until it’s resolved.
What you can expect from us
We fix what you report as quickly as we can, and once it’s resolved we help make the issue public.
- A reply within five business days
- With our assessment and when we expect to fix it.
- Updates as we go
- We keep you posted until the issue is resolved.
- Your details stay private
- We don’t share them with third parties without your consent.
- Credit, if you want it
- We name you as the finder when we publish about the issue, unless you’d rather stay anonymous.
- No legal action
- If you follow these rules, we won’t take legal action against you over your report.
- A reward
- For every non-trivial issue we didn’t know about. The amount depends on the severity and the quality of the report.
Not a security issue?
Questions, bugs and help with your site go through the contact form.
ContactHow Staatic keeps WordPress sites safe by design.
SecurityThis policy is adapted from the model text by Floor Terra, published under a Creative Commons Attribution 3.0 license at responsibledisclosure.nl.