Security
Security and vulnerability disclosure
How jeerc protects the code and targets you give it, and how to report a security issue in jeerc to us.
How your code and data are protected
- The SAST, SCA, IaC and secret scanners run with no network access.
- The GitHub App is read-only, and each clone uses a token that lasts one hour.
- The code scanners' clone is deleted when the scan ends.
- Each organisation has its own subdomain and portal database; stored tokens are encrypted with AES-256-GCM.
- No pentest starts until you have proved you own the host.
Vulnerability disclosure policy
Report a security issue in jeerc to [email protected], in English. Include the steps to reproduce it and what you could reach. The same contact is in our security.txt.
Scope
In scope: jeerc.com, the app and its API, and tenant subdomains (*.jeerc.com), but only within an organisation you created yourself.
Out of scope:
- Other tenants' data.
- shd.jeerc.com and mail.jeerc.com.
- Third parties, including Cloudflare, payment and identity providers, and GitHub.
- Denial of service and volumetric testing.
- Social engineering, physical attacks and spam.
- Scanner output with no proof of concept, and reports that only point out a missing header or a best practice.
Rules
- Use the least access you need to show the issue.
- If you reach another tenant's data or a person's data, stop, do not keep or share it, and report it straight away.
- No persistence and no pivoting to other systems.
- Give us reasonable time to fix the issue before you disclose it publicly.
What we commit to
- We acknowledge your report within 5 business days.
- We complete an initial triage within 10 business days.
- We send you a status update at least every 30 calendar days until the issue is closed.
- We coordinate disclosure 90 calendar days after your report by default, or later by agreement while a fix is in progress.
Rewards
We do not run a paid bug bounty. We will credit you on request.