We welcome reports from anyone who finds a security problem in SeatReaper. If you report in good faith under this policy, we will not pursue legal action against you, and we will work with you to understand and fix the problem.
How to report
Email support@seatreaper.com with "Security" in the subject. Please include:
- what you found and where (the URL or feature),
- the steps to reproduce it,
- what an attacker could do with it,
- how to reach you for follow-up questions.
Our contact details are also published in /.well-known/security.txt.
What we promise
- We confirm we received your report within 3 business days.
- We tell you whether we can reproduce it, and our plan, within 10 business days.
- We keep you informed until it is fixed, and credit you when we describe the fix, if you want to be credited.
In scope
- The SeatReaper web application and its API (seatreaper.com, seatreaper.vercel.app and any custom domains our customers use for SeatReaper).
- Data isolation between workspaces, authentication, two-step verification, Microsoft sign-in and session handling.
- How SeatReaper stores and uses the credentials customers give it for connected tools.
Out of scope
- Denial of service, load testing, spam and social engineering of our staff or customers.
- Reports from automated scanners without a demonstrated impact.
- Missing best-practice headers or settings with no exploitable impact.
- The services of our providers (for example Supabase, Vercel or Stripe) and of the tools customers connect. Report those to the vendor.
Testing rules
- Use only accounts you created. Do not access, change or delete data that is not yours; if you reach someone else's data by accident, stop, do not keep it, and tell us.
- Do not run tests that could degrade the service for others.
- Give us reasonable time to fix a problem before you disclose it publicly. We aim to fix critical issues within 30 days and will agree a disclosure date with you.
Safe harbor
Research done under this policy is authorized. We will not bring a claim against you, or support one, for accidental, good-faith violations of this policy. If a third party brings a claim related to your research under this policy, we will make it known that your activities were authorized.