Security and reporting vulnerabilities
If you found a vulnerability in KITSIS CRM, please tell us before anyone else. We will fix it and keep you informed.
How to report
Email security@kitsiscrm.com. Please include:
- what you found and where (address, request, screenshot);
- the steps to reproduce it;
- what an attacker could do with it, as far as you know.
English and Russian are both fine. Our security.txt has the same contact.
What we promise
- We reply within 7 days and tell you whether we can reproduce the problem.
- We keep you informed until it is fixed and tell you when it is.
- We do not take legal action against people who follow the rules below in good faith.
- If you wish, we thank you by name on this page after the fix.
We do not pay rewards for reports.
Rules for testing
- Test only on your own workspace. Do not access, change or delete data of other people. If you reach someone else’s data by accident, stop and tell us; do not keep a copy.
- Do not overload the Service: no denial-of-service attacks, no mass automated scanning.
- Do not use phishing, social engineering or physical attacks against us or our customers.
- Give us reasonable time to fix the problem, normally 90 days, before you publish anything.
In scope
- kitsiscrm.com
- app.kitsiscrm.com
- api.kitsiscrm.com
Services of other companies that we use (for example our hosting, Stripe or Google) are out of scope. Report problems there to those companies.
How we protect data
The measures are listed in the Data Processing Agreement, Annex 2.