Security disclosure policy

Security disclosure policy

We welcome reports from anyone who finds a security problem in CVSheets. This policy says how to report one and what you can expect from us.

How to report

Email security@cvsheets.com with:

• a description of the problem and its impact,
• the steps to reproduce it,
• the address or part of the service it affects.

Do not include other people's personal data in your report. Please do not open public issues about security problems.

Scope

This policy covers the CVSheets app, its API, public CV links and this website.

Safe harbour

If you act in good faith, follow this policy, stay within the scope above, avoid accessing or changing data that is not yours, and give us reasonable time to fix the issue before you disclose it, we will not take legal action against you and will treat your research as authorised.

While testing:

• use only accounts you own or have permission to use,
• stop and tell us as soon as you see someone else's data,
• do not degrade the service for other people.

What we do

• We confirm your report within 5 working days.
• We assess it within 10 working days and tell you what we plan to do.
• We keep you updated until it is fixed, and we agree with you when it can be disclosed.

Out of scope

• Volumetric denial of service.
• Social engineering of our staff or users.
• Findings that need a rooted or jailbroken device.
• Missing best-practice headers without demonstrated impact.

Rewards

We do not run a bounty programme. We are happy to thank you publicly if you wish.

How we protect your data

The details are in our privacy policy. In short: CV content, profile details and sign-in history are encrypted with a key for each account, keys are protected by Azure Key Vault, staff cannot read CVs without the owner's consent, and every staff action is recorded.