Use this process to report a security vulnerability you find in Assembled. We want to know about every vulnerability, and we keep you updated while we investigate. This article covers what to include in your report, how we respond, and which issues we investigate and may reward.
Report a vulnerability
Email the details to security@assembled.com. We reply as quickly as we can and keep you updated as we investigate.
Important: Don’t share the vulnerability publicly until we’ve fixed it. This protects all our customers while we work on a fix.
What to include in your report
Give us as much information as you can to help us reproduce and investigate the issue:
- Description: what the vulnerability is and how it works.
- Steps to reproduce: the steps someone would take to exploit it.
- Impact: what someone could do after exploiting it.
- Screenshots or recordings: anything that helps show the issue.
What happens after you report
- We confirm that we’ve received your report.
- If the issue needs investigating, our security team addresses it and keeps you informed of progress.
- We tell you when the issue is fixed.
- After it’s fixed, you’re welcome to discuss it publicly.
Give us reasonable time to respond, and don’t compromise other users’ accounts during your research.
Issues we don’t investigate
We don’t investigate reports that:
- Have no demonstrable security impact, such as CSV injection that doesn’t affect our systems.
- Are low impact and don’t affect our users’ security, such as missing best practices or disclosure of non-sensitive information.
- Need physical access to our employees’ devices, our offices, or other property.
- Only affect browsers that are more than 6 months out of date.
If you’re not sure whether your report qualifies, send it anyway. We’d rather have the chance to review it.
Rewards
We don’t have a formal bug bounty program, but we know security research takes time and effort, so we may reward verified security issues at our discretion.
We consider rewards only for issues you disclose to us privately, where your testing and research didn’t disrupt our service or compromise other users.
We don’t reward reports of phishing, spam, physical security breaches, denial of service, or other attacks that harm our team or customers.