Vulnerability Disclosure Policy

1) Rewards and Recognition

QuoteIt is a bootstrapped startup. We do not run an active, paid bug bounty program. We still read every report, and we review each case on its own merits, by its severity and its impact on our customers.

1.1 No-cash terms

This program does not promise or owe monetary compensation. Sending a report, or our accepting or fixing it, does not by itself entitle you to payment. If we choose to thank you for an exceptional finding with something more than recognition, that choice is ours alone, made case by case, and it is a gift, not payment for services.

1.2 Recognition

With your permission, we will credit you by the name or handle you choose when we fix a valid report, and in any advisory we publish about it.

1.3 Demands

A request for payment as a condition of reporting, withholding or disclosing a finding is outside this policy and its safe harbor.

2) Scope

2.1 In scope

• quoteit.me and the subdomains of quoteit.me that QuoteIt operates, including demo.quoteit.me.
• The QuoteIt web application and its APIs.
• Email that QuoteIt sends, where the problem is in how we send it.

2.2 Out of scope

• Services run by third parties we use, such as hosting, email, payment and analytics providers. Report those to the provider. A misconfiguration of such a service by us is in scope.
• Denial of service, load or stress testing, and anything that degrades the service for others.
• Social engineering, phishing or physical attacks on our staff, customers, offices or devices.
• Spam, or sending messages to people who did not ask for them.

2.3 Usually not accepted without a demonstrated impact

• Output of automated scanners that has not been confirmed by hand.
• Missing security headers, cookie flags or other best-practice notes without a working exploit.
• Clickjacking on pages with no sensitive action, and self-XSS.
• Software or version disclosure, and error messages, without a way to exploit them.
• Missing rate limits on actions that are not sensitive.
• Email authentication (SPF, DKIM, DMARC) notes without a demonstrated spoofed message.
• Problems that occur only in unsupported or outdated browsers.

If you are unsure whether something is in scope, ask us before you test it.

3) Rules for Testing

• Test only with accounts you own or have explicit permission to use. QuoteIt is invite-only; if you need a test workspace, write to us and we will set one up.
• Do not access, change, delete or keep data that belongs to anyone else. To show that one account can reach another's data, use two accounts of your own.
• If you come across personal data, customer content or credentials, stop at once. Do not save, copy or share them, and tell us right away.
• Use a vulnerability only as far as needed to confirm it. Do not pivot to other systems, keep access, plant anything or move data out.
• Keep automated requests to a modest rate, and do not try to degrade the service.
• Keep the details confidential until we have fixed the problem (section 6).
• Follow the law that applies to you.

3.1 Our automated defenses

QuoteIt blocks, quarantines or bans traffic and accounts that look like attacks, automatically and at once. Your testing may trigger this. That is a protective measure, not legal action against you. If it happens, write to us with the time, the account you used and what you were testing, and we will look into it.

4) How to Report

Email security@quoteit.me with the subject "Security report". Please include:

• the page, feature or address affected;
• steps we can follow to reproduce it, and a proof of concept if you have one;
• what an attacker could do with it;
• the test accounts you used and when you tested;
• whether you would like credit, and the name or handle to use.

Please do not put other people's personal data in your report. If you need to show that data was exposed, describe it or redact it.

5) What You Can Expect from Us

We are a small team. These are the times we aim for:

• an acknowledgement within 3 business days;
• a first assessment, including whether we can reproduce it, within 10 business days;
• updates as we work on a fix, and word when it is fixed;
• an honest explanation if we decide not to fix something, or do not consider it a vulnerability.

We fix the most severe problems first. We will not share your name or contact details outside QuoteIt without your permission, unless the law requires it.

6) Coordinated Disclosure

Please give us a reasonable time to fix a problem before you disclose it. We ask you to keep the details confidential until we have released a fix, or for 90 days from your report, whichever comes first. If a fix needs longer, we will tell you why and agree a new date with you. Before you publish, please tell us what you plan to publish and when, so that we can check that it does not expose our customers' data. We may publish our own advisory, and we will credit you in it if you wish.

7) Safe Harbor

When you research QuoteIt in good faith and follow this policy, we consider your research to be:

• authorized under computer misuse and anti-hacking laws, including India's Information Technology Act, 2000 and the U.S. Computer Fraud and Abuse Act, and we will not bring or support legal action against you for it, including for an accidental, good-faith step outside this policy that you report to us promptly;
• authorized under anti-circumvention laws, such as section 1201 of the U.S. Digital Millennium Copyright Act, and we will not bring a claim against you for working around technology measures in order to test;
• exempt from restrictions in our Terms of Service and acceptable use terms that would otherwise prevent the research, for that research alone;
• lawful, helpful to the security of the internet, and done in good faith.

If anyone else brings legal action against you for activity that followed this policy, we will make it known that we authorized it.

7.1 Limits

We can authorize research only on systems we own or control. This policy does not bind third parties, including our service providers, and it does not bind law enforcement or other authorities. Safe harbor does not cover activity that goes beyond this policy on purpose, causes harm on purpose, keeps or shares other people's data, or demands payment. If you are unsure whether something you plan is consistent with this policy, ask us first.

8) General

This policy does not create an employment, agency, contractor or partnership relationship, or any obligation to pay. We may update it; the effective date at the top shows the current version, and the version in effect when you tested applies to that testing. Questions about this policy can go to security@quoteit.me or legal@quoteit.me.