Skip to main content

Responsible Disclosure Policy

Bookwhen’s top priority is to keep customer data safe and secure. To ensure that we continue to work toward the best possible security for Bookwhen, we invite responsible disclosure of any security vulnerability you may find. We ask that you do not share this publicly. Instead, please email us.

We ask that you find and report vulnerabilities responsibly, with the following principles in mind:

  • You must not break any applicable law or regulations.
  • Do not access or modify, or attempt to access or modify, or expose any data that does not belong to you; only test on your own account.
  • Do not execute, or attempt to execute, a Denial of Service (DoS) attack.
  • Do not run any automated tools against our servers without prior coordination.
  • Do not exfiltrate data from our infrastructure (including source code, data backups, configuration files).
  • If you obtain remote access to our system, report your finding immediately. Do not attempt to pivot to other servers or elevate access.
  • Avoid scanning techniques that are likely to cause degradation of service to other customers (e.g. by overloading the site). This includes the spamming of contact forms, support emails, etc.
  • Keep within the guidelines of our Terms and Conditions.
  • Keep details of vulnerabilities secret until Bookwhen has been notified and had a reasonable amount of time to fix the vulnerability.

Scope

This Disclosure Policy applies only to vulnerabilities in Bookwhen products and services under the following conditions:

  • “In scope” vulnerabilities must be original, previously unreported, and not already discovered by internal procedures.
  • Volumetric vulnerabilities are not in scope; this means that simply overwhelming a service with a high volume of requests is not in scope.
  • Reports of non-exploitable vulnerabilities, or reports indicating that our services do not fully align with “best practice” (for example missing security headers) are not in scope.
  • TLS configuration weaknesses, for example “weak” cipher suite support or the presence of TLS 1.0 support, are not in scope.
  • This Disclosure Policy applies to everyone, including Bookwhen staff, third party suppliers and general users of Bookwhen public services.

Reporting and Reproducibility

If you believe you have found a security vulnerability, please submit your report to us on disclosure@bookwhen.com.

In your report please include details of:

  • The website, IP or page where the vulnerability can be observed.
  • A brief description of the type of vulnerability.
  • Steps to reproduce. These should be a benign, non-destructive, proof of concept. This helps to ensure that the report can be triaged quickly and accurately. It also reduces the likelihood of duplicate reports, or malicious exploitation of some vulnerabilities, such as subdomain takeovers.

After reporting an issue, our engineers must be able to replicate and reproduce the flaw that you have identified. If your report is too vague or is not clear will result in your finding not being eligible.

Bug Bounty

We value those who take the time and effort to report security vulnerabilities according to this policy. However, at this time, we do not offer a paid bug bounty programme.

What to expect

After you have submitted your report, we will usually respond to your report within 5 working days and aim to triage your report within 10 working days. We’ll also aim to keep you informed of our progress.

Priority for remediation is assessed by looking at the impact, severity and exploit complexity. Vulnerability reports might take some time to triage or address. You are welcome to enquire on the status but should avoid doing so more than once every 14 days. This allows our teams to focus on the remediation.

We will notify you when the reported vulnerability is remediated, and you may be invited to confirm that the solution covers the vulnerability adequately.

Legalities

This Disclosure Policy is designed to be compatible with common vulnerability disclosure good practice. It does not give you permission to act in any manner that is inconsistent with the law, or which might cause your organisation or partner organisations to be in breach of any legal obligations.

Cookies on Bookwhen

We use some essential cookies to make this website work.

We’d like to set additional cookies to understand how you use Bookwhen. We also use cookies set by other sites to help us deliver content from their services.

Manage cookies