Vulnerability
Disclosure
Program

MinuteBox employs a Vulnerability Disclosure Program (“VDP”). VDPs are programs designed to encourage and incentivize third-parties to disclose a system vulnerability upon discovery. The program is designed to promote disclosure directly to MinuteBox instead of, or in advance of, public disclosure. Moreover, the program is designed to counter any incentive of a third party to disclose a vulnerability to a malactor.

VDPs are primarily targeted toward security researchers, not bad actors. To show our appreciation to security researchers that disclose vulnerabilities, MinuteBox operates a stipend program to researchers that responsibly disclose vulnerabilities.

If you believe you’ve discovered a bug in MinuteBox’s security, please get in touch via this form. We will respond as quickly as possible to your report. We request that you not publicly disclose the issue until it has been addressed by MinuteBox.

MinuteBox provides a stipend for the confidential disclosure of any design or implementation issue that could be used to compromise the confidentiality or integrity of our users’ data (such as by bypassing our login process, injecting code into another user’s session, or instigating action on another user’s behalf).

A minimum stipend may be provided for the disclosure of qualifying bugs discovered. At our discretion, we may increase the stipend amount based on the creativity or severity of the bugs. If you report a vulnerability that does not qualify under the above criteria, we may still provide a minimum stipend if your report causes us to take specific action to improve MinuteBox’s security. The quantum of your stipend, if any, is at the sole discretion of MinuteBox.

As with most security stipend programs, we ask that you use common sense when looking for security bugs. Vulnerabilities must be disclosed to us privately with reasonable time to respond, and avoid compromise of other users and accounts, or loss of funds that are not your own. We do not stipend denial of service, spam, or social engineering vulnerabilities. The scope of this policy is the MinuteBox app and does not include any marketing or product pages. Vulnerabilities in third-party applications that use MinuteBox are not eligible for the program.

As with most security stipend programs, there are some restrictions:

• We will only provide a stipend to the first person to responsibly disclose a bug to us
• Any bugs that are publicly disclosed without providing us a reasonable time to respond will not be provided a stipend.
• Whether to stipend the disclosure of a bug and the amount of the stipend is entirely at our discretion, and we may cancel the program at any time
• Your testing must not violate any laws
• We can’t provide you a stipend if it would be illegal for us to do so, such as to residents of countries under current Canadian or U.S. sanctions
• You will be required to sign a acknowledgment and confirmation in a form provided by MinuteBox at its absolute discretion

Additional terms apply. Please inquire with our security team.