How to report
Email hello@mytribeerp.com with the subject Security report. Please include:
- what the issue is, and where (the address or app, and the screen or request);
- the steps to reproduce it, and what an attacker could do with it; and
- how we can contact you.
Please do not include other people's personal data in your report. If you came across any, tell us what kind of data it was, not the data itself.
What we will do
- Acknowledge your report within 3 working days.
- Keep you updated while we investigate and fix it.
- Tell you when it is fixed and, if you wish, credit you.
- Treat any suspected exposure of data between customers as our highest priority, at any time of day.
Scope
In scope:
- app.mytribeerp.com and api.mytribeerp.com;
- the MyTribeERP and MyTribeERP Gate apps for iOS and Android; and
- this website, mytribeerp.com.
Out of scope:
- attacks on our providers' own infrastructure (for example Google Cloud or Infobip) and on payment providers;
- social engineering or phishing of our staff, customers or residents;
- physical attacks, and attacks on estate gates or devices; and
- denial-of-service testing, or any test that degrades the service for others.
What we ask of you
- Test only with accounts you own or have permission to use. Never access, change or delete another customer's or resident's data beyond the minimum needed to show the issue, and stop as soon as you have shown it.
- Do not send real SMS or email to people who have not agreed to it.
- Do not use automated scanners at a volume that affects other users.
- Give us reasonable time to fix the issue before telling anyone else about it.
Good-faith research
If you act in good faith and follow this policy, we will not take legal action against you or ask the authorities to, for research that keeps to it. If you are unsure whether something is allowed, ask us first.