Security
Responsible Disclosure
How to report a security weakness to us, and the rules for doing it safely.
Reporting
If you believe you have found a security weakness in RPM, email support@rpmcode.com with "Security" in the subject. Include what you found, how to reproduce it, and what it could affect. We will acknowledge your report, keep you informed, and tell you when it is fixed.
The rules
- Test only with accounts and tenants you created yourself.
- Do not access, change, copy or delete other people's data. If you reach any by accident, stop, and tell us what you saw.
- No denial-of-service, load or spam testing, and nothing that degrades the service for others.
- No social engineering, phishing or physical attacks on our people or premises.
- Give us a reasonable time to fix the problem before telling anyone else.
Our promise to you
If you act in good faith and follow these rules, we will not take legal action against you, or ask anyone else to, for your research. We do not run a paid bug bounty, but we are grateful, and will credit you if you wish.