Policy
Responsible disclosure
This policy covers two situations: when we report a security issue to a third-party vendor, and when someone reports a security issue in one of our own systems to us.
When we report to a vendor
When our research line identifies a security issue in another company's application, we follow these steps in order.
- Initial contact. A short, high-level email goes to the developer contact address listed on the Google Play Store. It contains no technical detail, no exploit code, no sensitive data, and no step-by-step instructions that could enable harm.
- Acknowledgement. We wait for the vendor to confirm a point of contact for security communications. Nothing is published, shared, or sold during this period.
- Technical disclosure. Once a contact is confirmed, we share the affected component, the root cause, and a recommended fix.
- Remediation window. Vendors get reasonable time to remediate. We do not impose hard deadlines and we do not threaten public disclosure to apply pressure.
- Follow-up. At most two follow-ups, at least seven days apart. After 90 days with no response the case is recorded as no response — we still do not publish details unilaterally.
We do not access real user accounts, and any runtime testing is limited to test accounts we create ourselves. If user data is incidentally observed while establishing that an access control is missing, we do not retain or analyse it; it is deleted once the finding has been documented.
If you received a disclosure email from us
Reply to the address the message came from — normally research@sumosols.com — with the right security contact for your team. We will share technical detail securely once that contact is confirmed.
There is no obligation to engage us further. The disclosure is provided in good faith with no conditions attached: no fee, no request for account access, and no follow-on sales pitch.
Reporting an issue in our own systems
If you believe you have found a security issue in a Sumo Solutions website or product, we would like to hear about it. Email research@sumosols.com with:
- A short description of the issue.
- Steps to reproduce, where applicable.
- Any URLs, request payloads, or screenshots that help us understand the impact.
Safe harbour
Our commitment to good-faith reporters
We will not pursue legal action against, or report to law enforcement, anyone who reports a security issue to us in good faith — provided that the reporter (a) does not access more data than necessary to demonstrate the issue, (b) does not modify or destroy data, (c) gives us a reasonable opportunity to remediate before any public disclosure, and (d) does not violate any applicable law in the course of testing.
Out of scope
- Findings that depend on social engineering, physical access, or compromised user devices.
- Reports based on outdated dependency versions without a working proof of concept demonstrating exploitability.
- Best-practice recommendations not tied to a specific exploitable issue — for example, "you should add HSTS".
- Denial-of-service findings without a meaningful impact threshold.
Bounty and affiliations
We do not currently run a paid bug bounty programme. We are glad to publicly acknowledge researchers who report valid issues, where they want to be acknowledged.
Our own research work is independent, and is not conducted on behalf of or in affiliation with any bug bounty platform — HackerOne, Bugcrowd, Intigriti, or similar. We do not act as an intermediary between researchers and those platforms.