We're confident in our implementation around matters such as email spoofing and DKIM records. However, here are some issues we would be excited to hear about:
- Injection vulnerabilities
- Authentication or session problems
- Improper access to sensitive data
- Broken access controls
- Cross-site scripting
- Anything from the OWASP Top 10 Project
Upon discovering a vulnerability, we ask that you act in a way to protect our users' data:
- Inform us as soon as possible.
- Test against fake data and accounts, not our users' private data (please ask if you'd like a free account to work on this).
- Work with us to close the vulnerability before disclosing it to others.
Report your security concerns to CircleCI.
If you are reporting a sensitive issue, please encrypt your message using our security team's GPG key (ID: 0x4013DDA7, fingerprint: 3CD2 A48F 2071 61C0 B9B7 1AE2 6170 15B8 4013 DDA7)Email firstname.lastname@example.org