If you have found a security problem in Fondline, we want to hear about it, and this page says how to tell us and what we will do about it. It is our vulnerability disclosure policy.
Reporting a vulnerability
Email security@fondline.com. Please include what you found and where, the steps to reproduce it, and what an attacker could achieve — with any proof of concept, screenshots or request logs that help us see it. You do not need a Fondline account to report something, and you do not need to encrypt your report.
What we promise
- We acknowledge every report within three business days.
- We give you our assessment — whether it is in scope, and how serious we think it is — within ten business days.
- We fix confirmed issues on this timeline: critical within 7 days, high within 30, medium within 90. If something will take longer, we tell you why and when.
- We tell you when it is fixed, and we will credit you by name or handle if you would like that.
Safe harbour
If you follow this policy, we will treat your research as authorised, we will not pursue legal action or a law-enforcement referral over it, and we will say so if a third party raises the matter with us. In return we ask that you access only your own data or that of a test account you control; stop as soon as you have demonstrated the problem, without downloading, changing or keeping anyone else’s data; avoid degrading the service for other people; and give us a reasonable chance to fix the issue before telling anyone else.
Scope
In scope: fondline.com, including the application and its API, and Fondline’s handling of data obtained from Google APIs.
Out of scope: the platforms Fondline runs on, which have their own programmes; social engineering of our staff or users; physical attacks; anything that requires a compromised device or account; volumetric denial of service, spam or rate-limit exhaustion; scanner output with no demonstrated impact; and missing hardening headers or best-practice suggestions with no exploitable consequence.
Rewards
Fondline does not currently run a paid bug bounty. We are grateful for reports and will credit you publicly if you would like.
How we protect your data
Fondline never requests the contents of your mail: every Gmail read uses metadata format, which returns headers, labels and thread identifiers and cannot return a message body or attachment. Your Google credentials are encrypted with a managed key service and are decrypted only by the background service that needs them. Each workspace’s data is isolated in the database itself, not only in application code. Contacts imported from Google stay in the workspace that imported them. Our privacy policy describes what we store and how to delete it.
Questions: help@fondline.com