Reporting a security weakness

LINIEA holds families’ records: who they are, what they own and what they decided. If you have found a way to reach something you should not, we want to hear from you first, and we will work with you to put it right.

Where to report

This service has not published a security contact yet. Write to the service provider that runs it, and say that it is a security report; please do not include the details until somebody answers.

What to send

What you found and where: the address, the screen or the request.
How to see it for ourselves, step by step.
What someone could do with it, as far as you know.
How to reach you, and whether you would like to be thanked by name.

What is in scope

This website, its workspace and API, its sign-in service, and the families’ own addresses on it. Not in scope: reports from automated scanners without a demonstrated weakness, missing headers that change nothing, denial of service, and anything that needs a person to be deceived.

While you look

Use only accounts you own or were given for testing. Never open, change or keep a family’s records: if you reach one, stop, and tell us what you saw without copying it.
Do nothing that would slow the service for others, and send nothing to the people on it.
Give us a reasonable time to put it right before you tell anyone else; we will agree a date with you.

What we promise

An answer within five working days saying we have your report, and who is looking at it.
To keep you told as we confirm it and put it right, and to say when it is fixed.
Not to pursue or report anybody who looks for weaknesses in good faith and within these rules.