Reporting a security issue
Found a weakness in Expiro? Tell us first.
Where to write
Expiro holds customers' commercial contracts. If you have found a way to reach any of that, or to act as somebody else, email support@expiro.io with SECURITY in the subject, so it is not read as a support ticket. It reaches the person who wrote the code.
Include what you found, the steps to reproduce it, and what an attacker could do with it. A proof of concept helps; a video is fine if it is easier. The same address is published for tools at /.well-known/security.txt.
What to expect
- An acknowledgement within 2 working days.
- A first assessment within 5 working days, saying whether we consider it a vulnerability and why.
- A fix as fast as the severity warrants, and word when it has shipped.
- Credit, if you want it.
If we disagree that it is a vulnerability we will say so plainly, with the reasoning. Expiro is a one-person company: there is no bug bounty.
Please do not test against production
expiro.io is somebody's live contract data. Ask first and we will give you an account with data that belongs to nobody. Whatever you do, do not:
- use another customer's account, or read their data beyond what is needed to show the problem exists
- change or delete data that is not yours
- run automated scanning against expiro.io
Stopping as soon as you have proof, and telling us, is the whole thing.
Out of scope
- Reports from an automated scanner with no demonstrated impact.
- Missing headers or a TLS preference, absent a concrete attack.
- Social engineering, physical access, or denial of service by volume.
- Third-party services we use (Stripe, Fly.io, Cloudflare R2, Resend, Twilio) - report those to them.