We welcome reports from security researchers, customers and anyone else who finds a vulnerability in a Syott service. This policy explains how to report one to Syott Limited ("Syott"), what is in scope and what you can expect from us. It follows the principles in our Responsible Disclosure Policy.
How to report
Email security@syott.co. We prefer reports in English. Please include:
- what the vulnerability is and what an attacker could do with it;
- where it is: the URL, endpoint or component affected;
- step-by-step instructions to reproduce it, with any proof-of-concept code or screenshots;
- when you tested and the IP addresses you tested from; and
- whether you'd like to be credited and, if so, under what name.
You don't have to give us your real name. If you came across personal data, include only as much as you need to demonstrate the issue.
In scope
- syott.co and the subdomains of syott.co that Syott operates; and
- the web applications and APIs of Syott HR, Syott Recruit and Syott Company OS. Test only with accounts you're authorised to use.
Out of scope
- services run by third parties, even when they appear on our pages (such as our chat, analytics or bot protection providers); please report these to the provider;
- denial-of-service attacks and tests that rely on high volumes of traffic;
- social engineering, phishing and physical attacks against Syott, our staff or our customers;
- automated scanner output without a demonstrated, exploitable impact;
- missing security headers, cookie flags or email authentication records without a demonstrated impact;
- self-XSS, clickjacking on pages without sensitive actions, and other issues that need unlikely user interaction; and
- issues that only affect outdated or unsupported browsers.
Rules for testing
To stay within our safe harbour:
- use only accounts and data that belong to you or that you have permission to use;
- if you come across other people's data, stop, don't copy or keep it, and tell us;
- don't change or delete data, and don't degrade our services for others;
- don't run automated tools at a rate that could affect availability;
- give us reasonable time to fix the issue before you disclose it, as described in our Responsible Disclosure Policy; and
- comply with the law.
What you can expect from us
- We'll acknowledge your report within 3 business days.
- We'll tell you whether we can reproduce the issue and how serious we think it is.
- We'll keep you updated and let you know when it's fixed.
- We'll credit you publicly if you'd like us to.
- We won't take legal action against you for good-faith research that follows this policy.
Rewards
We don't currently run a paid bug bounty programme. If that changes, we'll update this page.
Contact
security@syott.co. Our security contact details are also published at /.well-known/security.txt.