Vulnerability Disclosure

1. Introduction

We take the security of our website and the information it holds seriously. If you have found a security problem, we want to hear about it, and this page tells you how to report it and what we will do.

This policy covers profitfirstprofessionals.ca and the services we run from it.

2. Reporting a security problem

Email support@profitfirstprofessionals.ca with "Security" in the subject line.

Please include:

• What you found, and where;
• The steps needed to reproduce it;
• What an attacker could do with it;
• Any supporting material — a screenshot, a request, a short proof of concept.

Please do not post it publicly before we have had a chance to fix it.

3. How we handle reports

• We will acknowledge your report within five business days.
• We will tell you whether we have been able to reproduce it, and what we intend to do.
• We will keep you updated while we work on it, and let you know when it is fixed.
• If you would like credit once the issue is resolved, tell us and we will be glad to give it.

We do not run a paid bug bounty. We are a small company and we would rather be straightforward about that than imply a reward we are not offering.

4. Responsible disclosure guidelines

If you are investigating our systems, please:

• Do stop as soon as you have confirmed a problem exists. Confirming access is enough; you do not need to demonstrate how far it goes.
• Do use only test data of your own.
• Do give us reasonable time to fix an issue before disclosing it — 90 days is the norm, and we will usually be much faster.

Please do not:

• Access, modify, download or delete information belonging to anyone else — our members' and their clients' information is exactly what this policy exists to protect;
• Run denial-of-service or volumetric tests, or anything that degrades service for others;
• Use social engineering, phishing, or physical attempts against our staff, our members, or our providers;
• Test systems operated by our providers rather than by us — those belong to HubSpot, Cloudflare, Stripe and others, and each has its own disclosure programme.

5. Our commitment to you

If you follow this policy in good faith, we will treat your report as an authorised contribution to our security. We will not pursue or support legal action against you, and if a third party brings action against you for research conducted under this policy, we will make it known that you were acting in accordance with it.

If you are unsure whether something is in scope, ask us first. We would much rather answer a question than receive a report about something you felt you had to test quietly.

Contact us

Profit First Professionals Canada Inc. 120 East Beaver Creek Road, Suite 200 Richmond Hill, ON L4B 4V1 Canada

support@profitfirstprofessionals.ca