Trust center
Vulnerability disclosure
If you believe you have found a security issue in Claform, we want to hear from you. This page explains how to report it and what happens next.
How to report
Email the details to our security address. Please include what you found, the steps to reproduce it, the affected URL or endpoint, and any proof of concept. Write in English if you can.
[email protected]You can also use the contact form with "Security" in the subject. Contact form
In scope
- claform.com and its pages
- app.claform.com (the Claform app)
- api.claform.com (the Claform API)
- Published survey links and embeds
- The Claform mobile SDKs
Out of scope
- Attacks that need physical access to a device or a compromised account
- Denial of service and load testing
- Social engineering of Claform staff or users
- Reports from automated scanners without a demonstrated impact
- Third-party services we use, which have their own programs
What we ask of you
- Use test accounts you created, and access only the data you need to show the issue
- Do not change or delete data that is not yours, and do not degrade the service
- Give us reasonable time to fix the issue before you share it publicly
- Delete any data you obtained once the report is closed
What we commit to
- We will acknowledge your report and keep you updated while we investigate and fix it
- We will not take legal action against research done in good faith under this policy
- With your permission, we will credit you once the issue is fixed
Rewards
Claform does not run a paid bug bounty program at this time.