Responsible disclosure policy

Dintero greatly appreciates input from security researchers wanting to help. We encourage responsible vulnerability research and disclosure. If you discover a vulnerability in any of our systems, please let us know about it so we can address it as quickly as possible.

Reporting a vulnerability

If you have discovered an issue you want to report, please do the following:

• Email your findings to security@dintero.com.
• Include details of what the issue is, how you discovered it, and attach any screenshots and such if possible. See the section below for additional details that are useful to include in the report.
• Ensure you give enough details for us to reproduce the issue.
• Please do not take advantage of the vulnerability you have found.
• Please do not disclose the vulnerability to others until it is resolved.

Vulnerability related information

1. Product or service in which the vulnerability is found.
   • Product or service name
   • Product or service URL
2. Anomalous behavior caused by the vulnerability.
3. Procedure for reproduction of the vulnerable condition.
4. Probability of the reproduction, choose one from the following three:
   • Always
   • Often
   • Rarely
5. Possible threat caused by the vulnerability.
6. Workaround.
7. PoC (Proof of Concept) code.
8. Other comments from the reporter (including severity assessment)
   • Describe the specific impact and how you would envision it being used in an attack scenario.
   • Do you believe the vulnerability is being exploited? Yes/No
   • Is an exploit publicly available? Yes/No

Scope

Any of Dintero services, products or web properties are in scope.

The following issues are currently considered out of scope:

• Volumetric/Denial of Service vulnerabilities (i.e. simply overwhelming our service with a high volume of requests).
• Missing email best practices (invalid, incomplete or missing SPF/DKIM/DMARC records, etc.).
• Self-XSS.
• Social engineering and physical security attacks.
• Brute force attacks.
• SSL/TLS configuration weaknesses.
• Clickjacking and other issues only exploitable through clickjacking.
• CSV/formula injection.
• Spoofing attacks.

Phishing

If you want to report suspicious emails that seems to be coming from Dintero, please forward it to phishing@dintero.com. If you have any questions or comments about the reporting process please use our Contact Form.

Bug Bounty

We currently do not offer a paid bug bounty program.

Ground Rules

We will not take legal action against security researchers reporting their findings in a responsible manner to us or our Customer Service Center by following the instructions in this document. We ask you to:

• Play by the rules and follow our Disclosure Policy.
• Do not violate the privacy of others by e.g. sharing or not properly securing data.
• Never attempt to gain access to another user’s account or data.
• Promptly report any vulnerabilities you find to us as described in this document.
• Do not disclose any vulnerabilities or associated details to anyone other than your dedicated Dintero security analyst.
• Allow our security team reasonable time to resolve the issue.

Feedback

If you want to give feedback or suggestions to this policy, submit your feedback to security+feedback@dintero.com. We are continually improving this policy and appreciate your input.