Sicurezza

If you have found a security issue, and it's not already known, then please send a report to [click to see email address].

Policy

We will investigate legitimate reports and make every effort to quickly resolve any vulnerability. To encourage responsible reporting, we will not take legal action against you nor ask law enforcement to investigate you provided you make a good faith effort to avoid causing harm to us, our users, and anyone else. This includes avoiding privacy violations, destruction of data, and interruption or degradation of services.

Scope

The following test types are excluded from the scope:

flooding (e.g. denial of service attempts, unthrottled vulnerability scans)
physical testing such as office access (e.g. open doors, tailgating)
social engineering (e.g. phishing, vishing)

The following issue types are excluded from scope:

Low severity issues, including:
- Issues that can be detected with tools such as Hardenize and Security Headers. We run regular scans with these services and try to improve our score gradually.
- Content injection issues.
- Cross-site Request Forgery (CSRF) with minimal security implications (Logout CSRF, etc.). In order for CSRF to be a valid issue it must affect some important action such as deleting one’s account.
- Missing cookie flags on non-security-sensitive cookies.
Disclosure of non-sensitive information. Our software is open source and we don't believe in security through obscurity.
- Stack traces containing only public information.
- Banner grabbing issues (figuring out what web server we use, etc.).
Theoretical issues without an accompanying proof-of-concept demonstrating vulnerability, including:
- Host header issues
- open ports
- out-of-date software
Issues with no security implications (e.g. spelling mistakes), they should be reported publicly on GitHub.
Issues in third-party services, they should be reported to the respective team.

We encourage hackers to read Web Hacking 101 and Breaking into Information Security: Learning the Ropes 101 to get a good idea of the type of issues that we are looking for.

We may modify the above guidelines at any time. Last update: January 18, 2018.

Hall of Fame

Thanks to the following researchers (most recent first) for having reported security issues to us via email:

EdOverflow — https://github.com/liberapay/liberapay.com/pull/467

Thanks to all hackers who have disclosed security issues to Gratipay on Hackerone, some of which also applied to Liberapay.

Thanks to the following people (most recent first) for having alerted Gratipay about security issues through other means: