Responsible disclosure

• This website, including the help center and these legal pages.
• The GarnerDocs app that firms and their teams sign in to, including sign-in, registration and password reset.
• Client upload links, the private links a firm sends its clients so they can upload documents without an account.

Only these hosts are in scope. Other subdomains aren't, even if they look like ours:

• garnerdocs.com

• Use accounts of your own. Sign up for your own workspace, and test client upload links by sending requests to email addresses you control.
• Only touch your own data. Don't access, change or delete anything that belongs to another workspace, a firm or its clients.
• Don't use a client upload link you weren't sent.
• Don't email anyone you don't know. Requests and reminders send real emails, so only send them to addresses you control.
• Keep it small. Test at a low rate, and stop as soon as you've shown the problem: don't go further to see what else you can reach.
• Don't leave anything behind. No backdoors, no persistent changes, and delete the test accounts and files you created when you're done.

• Anyone else's systems. The firms that use GarnerDocs, their websites and email, and their clients' devices aren't ours to open up for testing.
• Third-party services we use, such as the ones on our Subprocessors page. Please report problems in them to the company that runs the service.
• Social engineering or phishing of GarnerDocs staff, firms or their clients.
• Denial of service attacks, or any testing that sends large volumes of requests.
• Physical attacks on offices, people or equipment.
• Reports from automated scanners without a proof of concept showing a real impact.

Stop as soon as you see data that isn't yours, such as another firm's documents or a client's details. Then:

• Don't open, copy or download any more of it than you've already seen.
• Don't keep it. Delete anything you saved, once you've told us what it was.
• Don't share it with anyone, and don't include it in your report: describe what you saw and where, instead of attaching it.
• Tell us straight away, even if you haven't finished looking into the problem.

Email your report to [email protected].

Please don't post the problem publicly, or tell anyone else about it, until we've fixed it or agreed a date with you.

• What the problem is and where it is: the page, link or feature.
• The steps to reproduce it, and a proof of concept if you have one.
• What an attacker could do with it, as far as you know.
• How to reach you, if it isn't the address you're writing from.

We'll acknowledge your report within 3 business days of receiving it.

• We'll look into every report we receive.
• We'll keep you updated while we investigate, and tell you when it's fixed.
• We won't share your name or contact details without your permission.

If you follow this policy in good faith, we consider your research on the GarnerDocs systems in scope authorised by us. We won't bring a legal claim against you for it, and we won't ask the authorities to act against you for it.

This authorisation has limits:

• It covers only what's on this page. It doesn't cover the out-of-scope systems above, and it never covers looking at, keeping or sharing anyone else's data beyond what you saw before you stopped.
• We can only speak for ourselves. We can't authorise testing of systems we don't own or control, such as our providers' services or a firm's own systems, and we can't bind the police, prosecutors, courts or anyone else.
• If someone else takes action against you for research that followed this policy, we'll tell them, when asked, that it was authorised.

If you're unsure whether something you plan to do is covered, ask us first.

GarnerDocs doesn't run a bug bounty programme, and we don't pay for reports. We're grateful for every report all the same.