Security disclosure
If you believe you have found a security vulnerability in Heista, we want to hear from you. This policy explains how to report it, what is in scope, and how we will work with you.
Last updated:
How to report
In short
Email support@heista.co with the subject line “Security disclosure” and enough detail for us to reproduce the issue.
Please include:
- a description of the vulnerability and its potential impact;
- steps to reproduce it, including affected URLs, requests and expected and actual results;
- proof-of-concept code or screenshots where helpful, without any real customer data;
- how you would like to be credited, if at all.
Please report privately and give us reasonable time to fix the issue before sharing it publicly. A machine-readable contact is published at /.well-known/security.txt.
Scope
In short
Heista’s website, app and API are in scope. Third-party services we use, denial-of-service testing and social engineering are not.
In scope
- heista.co and www.heista.co, including the signed-in app
- The Heista API (/api/v1)
- The Heista browser extension
- Public repositories at github.com/Heista-co
Of particular interest
Authentication or authorisation bypass, access to another workspace’s data, server-side request forgery, injection, cross-site scripting with real impact, exposure of sensitive data, and bypasses of billing or usage limits.
Out of scope
- Denial-of-service or volumetric testing, and spam.
- Social engineering or phishing of our staff or customers, and physical attacks.
- Vulnerabilities in third-party services we use, such as our hosting, payment or AI providers. Please report those to the vendor.
- Automated scanner output without a demonstrated impact, such as missing headers or best-practice suggestions.
- Self-XSS, clickjacking on pages without sensitive actions, software version disclosure and email spoofing without a demonstrated attack.
Testing rules
In short
Test only with accounts you own, don’t access other people’s data, and don’t disrupt the service.
- Use only accounts you own or have explicit permission to test.
- Do not access, change or delete data that is not yours. If you encounter someone else’s data, stop, do not keep a copy, and tell us.
- Do not degrade the Service for others, and do not run automated tests that generate significant traffic or cost.
- Do not use a vulnerability beyond what is needed to demonstrate it.
What we commit to
In short
We acknowledge reports within 2 business days, keep you updated, and aim to fix confirmed issues within 90 days.
Acknowledge your report
- Target
- Within 2 business days
Confirm the issue and its severity
- Target
- Within 7 days
Fix confirmed vulnerabilities
- Target
- Within 90 days, and faster for critical issues
Let you know when it is fixed
- Target
- When the fix is deployed
| Step | Target |
|---|---|
| Acknowledge your report | Within 2 business days |
| Confirm the issue and its severity | Within 7 days |
| Fix confirmed vulnerabilities | Within 90 days, and faster for critical issues |
| Let you know when it is fixed | When the fix is deployed |
Safe harbour
In short
If you follow this policy in good faith, we won’t take legal action against you.
We consider security research carried out in good faith and in line with this policy to be authorised by us. We will not take legal action against you, or ask law enforcement to, for that research. If a third party brings a claim against you about research that followed this policy, we will make it known that your actions were authorised by us. This does not authorise access to third-party systems.
Recognition
In short
We don’t run a paid bug bounty, but we credit researchers who help us.
We do not currently offer cash rewards. With your permission, we will credit you publicly for a valid report once it is fixed, and we may offer complimentary Heista usage for significant findings at our discretion.