Responsible disclosure

Send an email to security@vikingqa.io.

• Describe the issue and the steps to reproduce it.
• Tell us which URL, account or project is affected.
• Add screenshots or a proof of concept if you have one.

A PGP key and a security.txt file are on our roadmap.

• Confirmation that we received your report, within two business days.
• Regular updates until the issue is fixed.
• Credit in our hall of fame, if you want it. Roadmap
• No legal action against research done in good faith and within this policy.

• app.vikingqa.io and its APIs
• vikingqa.io and docs.vikingqa.io
• The vikingQA browser extension

• Denial-of-service and volume attacks
• Social engineering of our staff or customers
• Findings in third-party services that we do not control
• Reports from automated scanners without a working proof

• Use only your own account and your own test data.
• Do not read, change or delete data that is not yours.
• Do not disrupt the service.
• Give us reasonable time to fix the issue before you publish.