Vulnerability disclosure policy

1. Scope

The policy covers the services that Usertick runs itself:

• usertick.com and the subdomains of usertick.com that Usertick operates, including the dashboard at app.usertick.com and the REST API;
• the website widget, including the npm package @usertick/snippet, and hosted survey pages;
• emails that Usertick sends, and their unsubscribe links;
• the Usertick apps for Slack, Microsoft Teams, HubSpot and Zapier, and the Usertick server for AI assistants;
• the DNS records and the configuration of the content delivery network and other providers that Usertick controls for its own domains, including subdomain takeover;
• vulnerabilities in the widget that affect the websites where it runs, which you demonstrate only on a website you control; and
• in the AI features and the Usertick server for AI assistants, issues that let an attacker access the data of another user or organization, take actions they are not allowed to take, or take data out, for example through prompt injection.

The policy does not cover:

• services that other companies run for Usertick, such as payments, the content delivery network and the documentation site; report a vulnerability in them to that company;
• customers’ own websites, and the content of their surveys; to report a survey that misuses Usertick, use Report abuse;
• denial of service, load testing, spam, social engineering of Usertick staff or customers, and physical attacks;
• reports without a demonstrated security impact, such as the output of an automated scanner, missing security headers or email authentication records, version numbers, or self-XSS; and
• the content of AI outputs, such as inaccurate or offensive answers or answers that get around the AI’s instructions, unless it leads to a security impact described above.

2. How to report a vulnerability

Email security@usertick.com, in English. Please include:

• the address or part of Usertick that is affected;
• the steps to reproduce the issue, and a proof of concept if you have one;
• what an attacker could do with it; and
• how Usertick can contact you.

Don’t include other people’s personal data in your report. If your research exposed personal data, describe what you saw instead of sending it. The same address is published in the security.txt file.

3. What Usertick does with your report

• Usertick acknowledges your report within 3 business days and tells you its initial assessment within 10 business days.
• It keeps you informed at least every 30 days until the issue is resolved, and tells you when it is fixed.
• Usertick aims to fix a confirmed vulnerability within these times from confirmation, depending on its severity under CVSS v4.0: critical, 7 days; high, 30 days; medium, 90 days; low, at Usertick’s discretion.
• If a report shows that personal data was accessed without authorization, Usertick handles it as a personal data breach: under its Data Processing Addendum for its customers’ data, and under the UK GDPR for the data it controls itself.
• Where the law requires it, Usertick reports actively exploited vulnerabilities in its software to the authorities, including under the EU Cyber Resilience Act.

Usertick does not run a bug bounty program and does not pay for reports. With your agreement, Usertick thanks you by name when it announces the fix and, where appropriate, requests a CVE identifier for the vulnerability.

4. Rules for research

Section 6 of the Terms of Service forbids security testing without Usertick’s written permission. This policy gives that permission for research that follows these rules:

• test only with accounts, organizations and surveys that you created yourself;
• don’t access, change or delete data that isn’t yours; if you reach it by accident, stop, report it, and delete any copy once you have reported it;
• use a vulnerability only as far as needed to show that it exists;
• don’t degrade the service for other people, and don’t run automated scans at a rate that affects it;
• don’t send email through Usertick to anyone other than yourself; and
• keep the vulnerability confidential, as section 6 of this policy describes.

5. Safe harbor

If you make a good faith effort to follow this policy, Usertick:

• considers your research authorized under the Computer Misuse Act 1990, the US Computer Fraud and Abuse Act and similar laws, and waives the restrictions in its Terms of Service on security testing, scraping and reverse engineering to the extent that research needs;
• does not bring a claim against you under the anti-circumvention provisions of the US Digital Millennium Copyright Act or similar laws because of that research;
• does not take legal action against you, or ask the authorities to act against you, because of that research;
• does not suspend or close your account because of that research; and
• if someone else takes legal action against you for that research, makes it known that Usertick authorized it.

Usertick can authorize research only on the services in scope that it runs itself. It can’t authorize research on other companies’ systems, it can’t waive the rights of its customers or of the people whose data they hold, and it can’t bind the authorities. If you are unsure whether something is allowed, ask at security@usertick.com before you do it.

6. Disclosure

Please don’t publish a vulnerability, or share it with anyone other than Usertick, until Usertick has fixed it or 90 days have passed since your report, whichever comes first. Usertick may ask you to extend this period where a fix needs more time and it is making reasonable progress, and you can agree a longer or shorter period with Usertick. Before you publish, tell Usertick what you plan to publish and when, and don’t publish personal data or details that would let others attack customers who are not yet protected. If Usertick has not acknowledged your report within 10 business days, write to security@usertick.com again; the 90 days still run from your first report.

7. Contact

Security reports go to security@usertick.com. The security page describes how Usertick protects customers’ data. Usertick’s security.txt file lists this contact, a link to this policy and the file’s expiry date, as RFC 9116 describes.