Responsible disclosure
Draft for legal review
If you find a weakness in Wumn, tell us privately first. We will fix it, and we will not take legal action against you for finding it in good faith.
How do I report a security problem?
E-mail Wumn’s security address with what you found and how to reproduce it.
Keep it private until we have fixed it.
- E-mailTo be confirmed
- Until thenWrite to the Grievance Officer at care@wumn.in, with “Security” in the subject.
Tell us:
- What you found, and where: the page or address.
- The steps to reproduce it, and what an attacker could do with it.
- Whether you saw anyone else’s account, order or data, so we can check it. Do not send us their data itself.
- How to reach you.
We acknowledge your report within 24 hours, keep you told while we work on it, and tell you when it is fixed.
What is in scope?
The shop at wumn.in, the partner site at partner.wumn.in, and Wumn’s own code behind them.
Not other companies’ services, and never attacks on people.
In scope:
- Signing in, accounts and sessions on wumn.in and partner.wumn.in.
- Seeing or changing another person’s orders, messages, measurements, addresses, payouts or shop.
- Payments, refunds or payouts going wrong in a way that costs someone money.
- Cross-site scripting, injection, and reaching files or data you should not reach.
Out of scope:
- Services run by other companies, such as the payment company, the courier and our hosting providers. Report those to them.
- Denial of service, load testing, spam, or anything that slows Wumn for others.
- Phishing, social engineering or physical attacks on our team, makers or customers.
- Reports from automated scanners with no proof of a real problem.
- Missing headers or settings with no way to exploit them.
Will I get into trouble for reporting?
Not from Wumn, if you act in good faith and keep to these rules.
We will not take legal action against you for research that keeps to them.
- Use your own accounts. Make test accounts; never sign in as someone else.
- Look only as far as you need to show the problem. If you reach someone else’s data, stop, keep no copy, and tell us.
- Do not change or delete data, take money, or disrupt Wumn for others.
- Do not ask for payment for your report, or threaten to publish it.
- Give us reasonable time to fix it before you tell anyone, and agree the date with us.
If you keep to these rules, Wumn treats your research as authorised, will not take legal action against you for it, and will say so if anyone asks. We cannot speak for other companies or for the authorities, and the law still requires us to report some incidents to CERT-In.
Does Wumn pay for reports?
Not today. Wumn has no paid bug bounty.
We read and answer every report, and tell you when it is fixed.
Wumn is a young company and does not pay rewards yet. If that changes, this page will say so first. A report never needs a reward to be taken seriously.