Security and vulnerability disclosure
We welcome reports from security researchers. If you believe you have found a vulnerability in Certus IQ, please tell us so we can fix it.
How to report
Email certus-iq-privacy@enish.com with a description of the issue, the steps to reproduce it, and the affected URL or feature. Please do not include other people's personal data in your report.
In scope
certus-iq.io and the Certus IQ web application, including its sign-in, profile and inbox features.
Rules
- Test only with your own account and your own data.
- Do not access, change or delete other people's data. If you reach it by accident, stop and tell us.
- No denial-of-service testing or automated traffic that degrades the service.
- No social engineering or phishing of our staff or users.
- Give us reasonable time to fix the issue before any public disclosure.
What to expect
We acknowledge reports within 5 business days and keep you informed while we investigate.
Rewards
There is no paid bug bounty at this time.