Reporting a Vulnerability

At MileIQ, we consider the security of our systems — and our users — a top priority, but no matter how much effort we put into system security, there can still be vulnerabilities present. If you discover a vulnerability, we would like to know about it so we can address it as quickly as possible. MileIQ is part of Bending Spoons, and potential vulnerabilities are handled by the Bending Spoons security team. Please submit your findings using our Responsible Disclosure Form, hosted by HackerOne.

This page is intended only for reporting security vulnerabilities. For compromised accounts, sign-in issues, billing, or other customer support enquiries, please contact MileIQ Support.

What We Ask of You

If you believe you have discovered a security vulnerability in a MileIQ service, please do the following:

• Submit your findings using our Responsible Disclosure Form, hosted by HackerOne.
• Do not take advantage of the vulnerability or problem you have discovered. In particular, you must not access, download, exfiltrate, modify, or access data beyond what is strictly necessary to demonstrate the vulnerability.
• You must not access or attempt to access accounts belonging to other users under any circumstances. Testing must be performed exclusively on accounts that you own.
• If the vulnerability involves personal data, you must not access or process such data except to the extent strictly necessary to report the issue, and you must not store, copy, or share any such data.
• Do not reveal the problem to others until it has been resolved.
• Do not use attacks on physical security, social engineering, denial of service (or any attack using large volumes of requests), spam, or third-party applications.
• Please provide sufficient information to reproduce the problem so that we can resolve it as quickly as possible. Usually the IP address or URL of the affected system and a description of the vulnerability will be sufficient, but complex vulnerabilities may require further explanation.

Ideally, a reported vulnerability will be achievable without physical access to a target's device. Reports produced by automated tools or scans are welcome and are handled through this same vulnerability disclosure process.

What We Promise

• We thank you for helping make MileIQ more secure.
• We will review every report we receive. Where a report identifies a genuine issue, we track it and work to remediate it on a risk basis, in line with the way we handle findings from our own independent, periodic penetration testing. We aim to acknowledge reports promptly and to keep you informed as we investigate, but we are unable to offer a guaranteed response time.
• As long as you act in good faith, comply with this policy, and applicable laws, we will not take legal action against you in regard to the report, and we will not pass on your personal details to third parties without your permission.
• In public information concerning the problem reported, we will credit you as the discoverer of the problem (unless you prefer otherwise).

Recognition and Remuneration

MileIQ does not operate a public bug-bounty program, and reports submitted through our Responsible Disclosure Form are handled as vulnerability disclosures rather than bounty submissions. As a rule, we do not offer financial rewards for such reports; however, in exceptional circumstances — for example a critical-severity finding — Bending Spoons may, at its sole discretion, offer a discretionary reward. We sincerely appreciate everyone who takes the time to help us keep our users' data safe.

Questions

If you have any questions about this policy, contact us at security@bendingspoons.com. Our reporting instructions are also published in our security.txt file.