Sign in Create your account

How to report a vulnerability

Last updated:

Overview

At Blnk Finance, the safety and security of our customers' data are paramount. We highly value contributions from our community to help identify and resolve vulnerabilities in our platform. If you discover a security issue with a CVSS score of 4.0 or higher, please report it to us.

How to report a vulnerability

Send an email to [email protected] with the following information:

  • Summary and Impact: A brief description of the vulnerability and its potential effects.
  • Steps to Reproduce: Clear, step-by-step instructions to replicate the issue.
  • Environment Details: Information about the environment you used (e.g., browser, operating system).
  • Proof-of-Concept: Any code snippets or methods that demonstrate the exploit, if available.

Scope of reporting

In scope:

  • Critical Areas:
    • Authentication bypass and privilege escalation.
    • Exposure of personally identifiable information (PII).
    • Unauthorized access to data outside the authenticated workspace.
    • SQL injection and remote command execution.
  • Affected Domains:
    • https://blnkfinance.com
    • https://cloud.blnkfinance.com
    • https://api.cloud.blnkfinance.com
  • Platforms: Help Scout, Discord, Slack, and GitHub integrations

Out of scope:

  • Automated scanning activities.
  • Social engineering attempts, including targeting Blnk employees.
  • Password brute force attacks.
  • Clickjacking on non-sensitive pages.
  • Missing security headers without demonstrable exploitability.
  • Issues reproducible only under highly unlikely conditions (e.g., outdated browsers, exotic operating systems).
  • Denial of Service (DoS) attacks.
  • Physical access attacks.
  • Theoretical vulnerabilities without proof of concept.
  • Logic bugs that allow bypassing account limitations for free or paid features.

Our commitment

  1. Acknowledgment: We will confirm receipt of your report within 48 hours.
  2. Investigation: Our security team will assess and prioritize the vulnerability.
  3. Resolution: We are dedicated to fixing reported issues promptly.
  4. Communication: You will receive updates on the status of your report and any actions taken.
  5. Confidentiality: All reports are handled with strict confidentiality to protect both you and our users.

Responsible reporting guidelines

  1. Test Responsibly: Only assess vulnerabilities on your own account or with explicit permission.
  2. Respect Privacy: Avoid actions that could lead to data breaches, data loss, or service interruptions.
  3. Limit Access Attempts: Do not attempt to gain unauthorised access beyond what is necessary to demonstrate the vulnerability.
  4. Maintain Confidentiality: Do not disclose the vulnerability publicly before reporting it to us, and allow us adequate time to address the issue.