We welcome reports of security vulnerabilities in Keenfunnel's systems. This policy explains what you may test, how to report and what you can expect from us.
Scope
In scope:
- keenfunnel.com and its subdomains;
- keenfunnel.agency and its subdomains;
- legal-center.keenfunnel.com.
Out of scope: third-party services we use (please report those to their owners), our clients' systems, and physical or social-engineering attacks.
How to report
Email legal@keenfunnel.com with:
- the affected URL or system;
- a description of the issue and its impact;
- the steps to reproduce it, and any proof of concept;
- how we can contact you.
Rules for testing
- Test only systems in scope, and only as far as needed to confirm the issue.
- Do not access, change or delete data that is not yours. If you reach personal data, stop and tell us.
- Do not run denial-of-service tests, send spam, or use automated scans that degrade our services.
- Do not use social engineering, phishing or physical attacks.
- Give us reasonable time to fix the issue, and do not disclose it publicly until we agree.
What we promise
- We acknowledge your report within 5 business days and keep you informed until it is resolved.
- If you follow this policy in good faith, we consider your research authorized, we will not take legal action against you, and if anyone else complains we will tell them you acted with our permission.
- Once the issue is fixed, we credit you publicly if you wish.
- We do not pay rewards for reports.