Shipwire

Description

Shipwire makes it easier for e-commerce businesses to outsource their logistics so they can focus on making and selling great products. Our platform manages order and inventory data for millions of merchants and customers worldwide, coordinating the shipping of their products around the globe. Platform and physical inventory security, data privacy, and our customers' trust are paramount to us. We value the security research community as they help us to ensure our systems are protected as best as possible. If you are a security researcher and believe you have discovered a vulnerability in our service, we would appreciate your disclosing it to us in a responsible manner. We will validate, respond to, and fix or mitigate any vulnerabilities reported to us in compliance with this responsible disclosure policy. We won't take legal action against or terminate access of anyone who reports vulnerabilities in compliance with this responsible disclosure policy. Guidelines for Testing Whether directly or through a third party, researchers must not: Attempt a Denial of Service attack against the Shipwire service Knowingly use the Shipwire service in a manner intended to degrade performance for other service users Knowingly use the Shipwire service in a manner intended to corrupt or destroy data for other service users Knowingly use the Shipwire service in a manner intended to fraudulently ship products Knowingly post any malware or malicious software in such a manner that it could be retrieved or linked from the Shipwire service Knowingly access a Shipwire service account or account data that they do not own or have the rights to access Knowingly cause unsolicited or inappropriate e-mail to be sent from the Shipwire service Attempt to demand financial compensation in exchange for security vulnerability information Researchers must: Perform research only within the scope set out below; Use the identified communication channels to report vulnerability information to us; and Keep information about any vulnerabilities you’ve discovered confidential between yourself and Shipwire until we’ve had 30 days to resolve or mitigate the issue. If you follow these guidelines when reporting an issue to us we commit to: Promptly respond to your communication, acknowledging receipt of your report within 3 days Acknowledge whether the issue is considered a security issue Provide an estimated time to mitigate or fix acknowledged security issues Recognize your contribution on our Security Researcher Hall of Fame, if you are the first to report the issue and we make a code or configuration change based on the issue. Treat you to a beverage of your choice, next time you're in Shipwire's neighborhood (subject to availability and in accordance with any local laws). Thank you for helping keep Shipwire secure.

Targets

Out of scope Any services hosted by 3rd parties are excluded from scope. These services include: Our customers' systems Our customers' customers' systems Shopping carts, marketplaces, ERP, or other commerce platforms Shipping carriers Warehouse systems In the interest of the safety of our users, staff, the Internet at large and you as the security researcher, the following test types are excluded from scope and not eligible for a reward: Findings from physical testing such as office access (e.g. open doors, tailgating) Findings derived primarily from social engineering (e.g. phishing, vishing) Findings from applications or systems not listed in the ‘Targets’ section Functional, UI and UX bugs and spelling mistakes Network level Denial of Service (DoS/DDoS) vulnerabilities Things we do not want to see: Personally identifiable information of accounts or users (PII) that you may have found during your research