In Scope

• wakatime.com

• api.wakatime.com (web only, not used for email)

We recently added a new feature: Profile Image Uploading

Please test image uploads first, since most other features have already been tested thoroughly:

https://wakatime.com/settings/profile/photo

Out of Scope Vulnerabilities

Vulnerabilities below will be marked NA or Informative.

• Session Fixation (We use session cookies and we like them http://bit.ly/2tw19Gd)

• Insufficient Session Expiration

• Weak Password Policy (See http://bit.ly/2uFjwXt)

• Password Reuse (We allow any password, even passwords used previously)

• CSRF Cookie Without 'HttpOnly' Flag

• Beast Attack (Fixed in browsers not sever)

• Username Enumeration

• Software version disclosure

• Denial of service

• Spamming

• Phishing

• Social engineering

Please consolidate the same vulnerability reports when only the page/url/params changes.

View changes to this policy