Vulnerability Disclosure Policy

We take the security of our products, services, and users seriously. We welcome security researchers who help us identify and responsibly disclose potential vulnerabilities.

If you believe you have discovered a security vulnerability, please report it to:

security@sesame.com

Please include enough information for us to understand and reproduce the issue, including:

• A description of the vulnerability and its potential impact
• The affected product, service, URL, or endpoint
• Steps to reproduce the issue
• Any proof-of-concept code, screenshots, or other supporting information
• Your preferred contact information, if you would like us to follow up

Please submit one vulnerability per report when practical.

If you make a good-faith report under this policy, we will:

• Acknowledge receipt of your report within 3 business days
• Make a reasonable effort to keep you informed of our investigation and remediation progress
• Work to validate and address legitimate security issues in a timely manner based on their severity and complexity
• Credit you for the discovery, if you would like public recognition
• Consider monetary rewards for high-quality reports that identify meaningful security vulnerabilities

Reward amounts, if any, are determined by us based on factors including severity, impact, report quality, exploitability, and whether the issue was previously known. This is not a guaranteed bug bounty program, and duplicate, low-impact, or otherwise ineligible reports may not receive a reward.

We consider security research conducted in accordance with this policy to be authorized.

If you make a good-faith effort to comply with this policy, we will not initiate or recommend legal action against you for your research. If a third party initiates legal action against you in connection with activities conducted in accordance with this policy, we will take reasonable steps to make it known that your activity was conducted pursuant to this policy.

We ask that you:

• Make a good-faith effort to avoid privacy violations, degradation of our services, disruption to production systems, and destruction or modification of data
• Access only the information necessary to demonstrate the vulnerability
• Do not access, download, retain, or share other people's data beyond what is necessary to demonstrate the issue
• Do not use a vulnerability to compromise additional systems or accounts
• Do not perform denial-of-service or resource-exhaustion testing
• Do not use social engineering, phishing, physical attacks, or attacks against our employees or users
• Give us a reasonable opportunity to investigate and remediate a reported vulnerability before publicly disclosing it

If you are uncertain whether a particular activity is permitted, contact us before proceeding.

Unless otherwise stated, this policy applies to publicly accessible products and services operated by Sesame.

Third-party services, integrations, and infrastructure not operated by us are outside the scope of this policy. Vulnerabilities in third-party products should generally be reported directly to the applicable vendor.

We support coordinated vulnerability disclosure. We ask that you allow us reasonable time to investigate and remediate an issue before publishing details that could put our users or systems at risk.

We will work with researchers in good faith to agree on an appropriate disclosure timeline.

Thank you for helping us keep our products and users secure.