CamplaxUse the report form and choose “A security problem in Camplax itself”, or write to security@camplax.dev. Tell us what you found, where, and the steps to see it again. Do not put other people’s data, credentials or working exploit code in a public place.
1. In scope
- The Camplax website and console at camplax.dev and app.camplax.dev.
- The Camplax API at api.camplax.dev and camplax.dev/v1, and the camplax command-line tool.
- The isolation between customers: anything that lets one account, project or app read, change or reach another’s data, secrets, network or compute.
Apps that customers run under *.camplax.app or on their own domains belong to those customers. Report a problem in one of them to its owner; report an app that is attacking people through the abuse form.
2. Out of scope
- Denial-of-service testing, load testing, or anything that degrades the service for others.
- Social engineering of Camplax staff or customers, and physical attacks.
- Spam or phishing aimed at Camplax users.
- Findings that need a rooted or compromised device, or an outdated browser.
- Reports from automated scanners with no demonstrated impact, missing headers with no exploit, and self-XSS.
3. Rules for testing
- Test only against accounts and projects you own or have the owner’s written permission to test.
- Do not access, change or delete other people’s data. If you reach any by accident, stop, keep no copy, and tell us what you saw.
- Do not degrade the service, spend other people’s credits, or send mail to people who did not ask for it.
- Give us a reasonable time to fix the problem before you publish it. We aim to agree a date with you; the default is [[default number of days a reporter waits to go public]] from your report.
4. Safe harbour
If you make a good-faith effort to follow this policy, Camplax considers your research authorised, will not pursue or support legal action against you for it, and will say so if someone else does. If you are unsure whether something is allowed, ask first through the report form.
5. What we do
- Confirm we received your report within [[how soon Camplax confirms it received a security report, in business days]].
- Tell you whether we can reproduce it, and keep you told as we fix it.
- Credit you when the fix is announced, if you want to be named.
Camplax does not offer payment for reports.