Security reward programme

• bestwebby.com, including the documentation and the Academy
• The merchant dashboard at dashboard.bestwebby.com
• Storefronts at *.bestwebby.com, including their cart, checkout and customer accounts
• The BestWebby API at dashboard.bestwebby.com/api/v1, as described in the API reference

These are not covered by the programme, and are not authorised:

• Social engineering or phishing of our staff, merchants or their customers
• Physical attacks on our offices, data centres or people
• Denial of service, load or stress testing, and anything that exhausts resources
• Services run by third parties that we use or link to, such as payment processors, carriers, email and messaging providers, and our hosting and network providers. Report those to the provider.
• Stores on a merchant’s own domain, unless the store is your own test store
• Spam, and reports that only say a rate limit is missing or could be higher
• Output from automated scanners without a working proof of the impact
• Missing security headers, cookie flags or email (SPF, DKIM, DMARC) settings with no demonstrated impact; self-cross-site scripting; logout cross-site request forgery; software version disclosure; issues that need an out-of-date browser or a compromised device

• Test only stores and accounts you own, or test accounts we set up for you. If you need one, ask us at security@bestwebby.com before you start.
• Never try to access, change, keep or delete another merchant’s or shopper’s data. If you come across any, stop at once, do not look further, report it to us straight away, and delete any copy you have.
• Use the smallest proof that shows the issue. Do not use it to go further into our systems, keep access, or move to other accounts.
• Automated tools may only be pointed at your own test store, at no more than 5 requests a second in total, and must not degrade the service for anyone else.
• Do not disclose the issue publicly, or to anyone other than us, until we have released a fix, or for 90 days after your report if that comes first, unless we agree a different date with you in writing.
• Follow the law, and the rest of our Terms of Service, while you test.

If you make a good-faith effort to follow these rules:

• we consider your research authorised, and we waive clauses 22 and 23 of our Terms of Service to the extent the research needs;
• we will not bring legal action against you or report you to the police for it; and
• if someone else takes action against you over it, we will make it known that your research was authorised under this programme.

This does not cover research that ignores these rules on purpose, or systems that are not ours: we cannot authorise testing of a third party’s service. If you are unsure whether something is allowed, ask us at security@bestwebby.com before you do it.

Email security@bestwebby.com. Our contact details are also published at /.well-known/security.txt. Please include:

• the address, page or API endpoint affected;
• the steps to reproduce it, and a proof of concept;
• what an attacker could do with it;
• the store or accounts you used; and
• the name you would like to be credited under, if any.

Do not send us other people’s personal data: redact it from screenshots and logs. A PGP key is available on request.

We acknowledge every report within 3 business days (Toronto, Ontario). Once we have looked into it we tell you whether we accept it and what severity we give it, we keep you informed while we work on it, and we tell you when it is fixed so that we can agree when you may publish.

Rewards are paid in Canadian dollars, at our discretion, based on the real impact of the issue and the quality of the report:

• Critical: up to CA$3,000. Reading or changing another merchant’s store, orders or customer data; taking over another account; running code on our servers; changing what a shopper is charged.
• High: up to CA$1,000. Getting round sign-in, two-step verification or a team member’s permissions; stored cross-site scripting in the dashboard that runs for another user; reading secrets such as API keys or payment settings that are not yours.
• Medium: up to CA$300. Cross-site request forgery on a meaningful action; reflected cross-site scripting; disclosure of limited information about another account.
• Low: our thanks and a place in the hall of fame. Issues with a real but small security impact.

• One reward per issue. Several reports of the same root cause count as one issue.
• The reward goes to the first person to report an issue. There is no reward for an issue we already know about, one that has already been reported, or one outside the scope above.
• You must have followed these rules.
• Our employees and contractors, people who were in the last 12 months, and their households, cannot receive a reward. Nor can anyone we are not allowed by law to pay.
• We pay by a method we choose once the issue is confirmed. Any tax on a reward is yours.

Researchers who agree to be named are listed here once their report is resolved. No one is listed yet.

We may change these rules or end the programme at any time. The rules in force on the day you send a report apply to that report. Something on a store hosted on BestWebby that is not a vulnerability, such as phishing, counterfeits or a scam, goes to report abuse instead.