Reporting a security problem

Email support@syncoretech.net with “Security report” in the subject. Please include:

• what you found and where (the page or address),
• the steps to reproduce it,
• what someone could do with it, as far as you know,
• how we can reach you, and whether you’d like to be thanked by name.

Please write in English. Don’t send other people’s personal data in your report.

You can send a report at any time and it’s logged straight away. Nobody is on call outside our support hours, so we review security reports with high priority during our support hours, Monday to Friday, 09:00–17:30 (our time zone, UTC+4), except public holidays.

• Our website at syncoretech.net.
• The SynCore app at app.syncoretech.net, including file storage, share links and billing pages.
• Our sign-in and account pages.

Out of scope: the services of the companies that help us run SynCore (listed on our Subprocessors page), which you should report to the company concerned, and reports that only list missing best practices without showing a real risk.

• Test only with accounts you created yourself, and only on your own data.
• Stop as soon as you can show the problem, and tell us straight away.
• Give us reasonable time to fix it before telling anyone else.

• Access, change or delete other people’s data, or keep any data you came across.
• Disrupt the service: no denial-of-service testing, no flooding, no automated scanning at high volume.
• Use social engineering, phishing or physical attacks against anyone, including our contractors and suppliers.
• Send spam or upload harmful files to test us.

• We’ll confirm we’ve received your report within 2 working days.
• We’ll tell you what we think of it within 5 working days.
• We’ll keep you updated, and tell you when it’s fixed.
• If you act in good faith and follow this policy, we won’t take legal action against you or ask anyone else to, for your research.

We don’t pay cash rewards. With your permission, we’ll thank you by name on this page once the problem is fixed.

No reports have been fixed yet, so there’s nobody to thank here yet.

Machine-readable contact details are at /.well-known/security.txt. How we protect the service is on our security page.