Vulnerability Disclosure Policy
If you have found a security vulnerability in CoRATES, we want to hear about it. This page explains what to report, how, and what you can expect from us. It is also linked from /.well-known/security.txt.
How to report
Email support@corates.org with a description of the issue, the steps or request sequence needed to reproduce it, the impact you believe it has, and any suggested fix. Do not open a public GitHub issue for security reports.
Please do not access, modify, or download data that is not your own beyond what is needed to demonstrate the issue. If you encounter another user's data, stop and report it.
Scope
In scope:
- corates.org, including the web application and every /api endpoint
- Real-time synchronization and collaboration services
- PDF upload, storage, and rendering
- Authentication, sessions, and access control between projects and workspaces
Out of scope:
- Denial of service, load testing, or automated scanning that degrades the service
- Social engineering or phishing of CoRATES users or staff
- Vulnerabilities in third-party services we use (Cloudflare, Stripe, Postmark, Google, ORCID); report those to the vendor
- Reports from automated tools without a demonstrated impact
- Missing security headers or best-practice findings with no exploit path
What to expect
- Acknowledgement of your report within 48 hours
- An initial assessment and expected timeline within 7 days
- Updates as we investigate, and notice when the issue is fixed
- Public credit in our security acknowledgements if you would like it, once the fix is deployed
We ask that you give us 90 days from your report before publishing details, or until a fix is deployed if that is sooner. If we need longer for a complex issue, we will tell you why.
Safe harbor
We consider security research conducted in good faith and consistent with this policy to be authorized. We will not pursue or support legal action against you for it, and if a third party initiates action, we will make it known that your research was conducted under this policy.
Good faith means you act within scope, avoid privacy violations and service disruption, do not exploit an issue beyond what is needed to demonstrate it, and report promptly. If you are unsure whether something is covered, ask us first at support@corates.org.