We practice what we advise. If you believe you have found a security vulnerability in this website or any Piper Secure system, we want to hear about it.
How to report
Email the security contact listed in our security.txt file. Please include a description of the issue, the steps to reproduce it, and any proof-of-concept you have.
Please do
- Give us reasonable time to investigate and fix the issue before any public disclosure.
- Use test accounts and your own data wherever possible.
- Stop and contact us as soon as you have confirmed a vulnerability.
Please don’t
- Access, modify or delete data that isn’t yours.
- Run denial-of-service, spam or social-engineering tests.
- Test systems belonging to our clients. They are out of scope.
Our commitment
We will acknowledge your report within three business days, keep you informed as we work on a fix, and credit you if you wish. We will not pursue legal action against good-faith research that follows this policy.