If you find a security issue in CrineonERP or on this website, please tell us. We would rather hear about it from you than from someone who means harm.
How to report
Email info@crineonerp.com with “Security” in the subject. Please include:
- what you found and where: the address, the page or the feature;
- the steps to reproduce it, and what an attacker could do with it;
- how we can contact you.
Please don’t include other people’s personal data beyond what you need to show the issue.
What happens next
- We confirm we’ve received your report within one to two business days.
- We look into it, keep you updated, and tell you when it’s fixed.
- With your permission, we thank you by name once the fix is out.
We don’t pay rewards for reports at present.
What’s in scope
- crineonerp.com and its subdomains.
- CrineonERP sites we host for customers, where the issue is in CrineonERP itself.
Out of scope: denial-of-service testing, social engineering or phishing of our staff or customers, physical attacks, and issues in other companies’ services, which should go to those companies.
Please
- Test only against your own account or data, and stop as soon as you have shown the issue.
- Don’t access, change or delete data that isn’t yours.
- Don’t degrade the service for anyone else.
- Give us reasonable time to fix the issue, normally 90 days, before you share it with anyone else.
Our promise
If you act in good faith and follow this policy, we won’t take legal action against you for your research, and we’ll treat your report as authorised.