Sign in Create free account

Security

Vulnerability Disclosure

If you find a security problem in Chat with Work, tell us. We'll answer, fix it, and won't come after you for looking in good faith.

How to report

Email security@chatwithwork.com. Write in English or German. Include:

  • what you found, and where: the address, app, or version;
  • the steps to reproduce it, with any request or proof of concept;
  • what someone could do with it;
  • whether, and how, you'd like to be credited.

Please don't put the details anywhere public until we've fixed it. The same address is in our security.txt.

What's in scope

  • chatwithwork.com and staging.chatwithwork.com, including the API and sign-in.
  • The iPhone, iPad, and Android apps.
  • Chat with Work Desktop, which is open source: github.com/crmne/chatwithwork-local-agent.
  • The Chat with Work apps for Slack, Discord, and Campfire, and the GitHub App.
  • chatwithwork-apps.com, where tools' interfaces run.
  • The self-hosted image's code. A self-hosted install itself belongs to the organization that runs it: report its configuration to them.

Out of scope

  • The services you connect, and our providers (Google, Microsoft, AWS, Slack, Hetzner, and others): report to them.
  • Denial of service, load testing, and anything that degrades the service for others.
  • Social engineering, phishing, or physical attacks on us or our users.
  • Spam or rate limits on pages with nothing sensitive behind them.
  • Scanner output, missing headers, or best practices with no way to exploit them.

While you look

  • Use your own account and organization, and test data. A free account is enough.
  • Don't read, change, or delete anyone else's data. If you reach some by accident, stop, don't keep it, and tell us.
  • Take only what you need to show the problem, and delete it once you've reported it.

What we promise

  • We acknowledge your report within 3 business days.
  • We tell you what we found and keep you updated until it's fixed.
  • We fix confirmed problems as fast as their severity calls for, and tell you when.
  • We credit you, if you'd like, once it's fixed.

Chat with Work is a small company: Carmine Paolino, its founder, reads and answers every report himself.

Safe harbor

If you research and report in good faith and follow this page, we consider your research authorized, we won't take legal action against you or report you to the authorities for it, and we'll say so if anyone else does. If you're unsure whether something is allowed, ask us first.

No bounty

We don't pay for reports. We're grateful for them, and we'll thank you publicly if you'd like.