No technology is perfect, and Worklytics believes that working with skilled
security researchers across the globe is crucial in identifying weaknesses in
any technology. If you believe you've found a security issue in our product or
service, we encourage you to notify us. We welcome working with you to resolve
the issue promptly.
- Let us know as soon as possible upon discovery of a potential security issue, and we'll make every effort to quickly resolve the issue.
- Provide us a reasonable amount of time to resolve the issue before any disclosure to the public or a third-party.
- Make a good faith effort to avoid privacy violations, destruction of data, and interruption or degradation of our service. Only interact with accounts you own or with explicit permission of the account holder.
Keep in mind Hackerone's definition of Vulnerability
__. For the purposes of this
program"design flaws" / "failures to adhere to security best practices" will
generally be resolved as an informative report rather than a confirmed
Reports should have either 1) clear, concise reproducible steps, or 2) a
working proof-of-concept (POC) - or they may be marked as "Needs More Info"
until more detail is provided. If we mark a report as "Needs More Info" and do
not receive a response within 7 days, we may close it as "Invalid/Not
While researching, we'd like to ask you to refrain from:
- Using automated scanners unless you 1) identify with your hackerone email address in the User-Agent string, and 2) limit your requests to maximum rates of 1 req/sec and 10,000 req/day
- Denial of service
- Social engineering (including phishing) of Worklytics, Co staff or contractors
- Any physical attempts against Worklytics, Co property or data centers
- EMail DNS configurations : We consider email spoofing due to lack of DMARC as out-of-scope. We'll evaluate issues with SPF/DKIM, if they open a vector (eg, mail delivered to inbox) - but generally we consider these as low severity, as depend on participation from the targeted user as well as weak security policies of their email system - neither of which we can fully overcome. For example, SPF
~all is the recommended practice by major providers like SendGrid, even if some scanners suggest you should use
- Demo Request Form : if you test the demo request form on www.worklytics.co __, please refer to Hackerone clearly in your submission. Either use your Hackerone email as the email address in the form, or clearly state"HACKERONE" in the comment section.
- Subdomain Takeovers : if you report a subdomain takeover, you MUST include a valid PoC of a claimed subdomain takeover, such as:
- send an email from the claimed subdomain to
- host a file on the claimed subdomain named with your hackerone username (eg,
Common False Positives
The following issues have been repeatedly reported as vulnerabilities, but we
(and many others) don't consider them to be:
- disclosure of Wordpress user ids / names is not a security vulnerability __.
- lack of DNS CAA record __- this is a proposed IETF standard, not yet adopted or supported by all CAs; major websites, like microsoft.com, amazon.com, etc don 't maintain a CAA DNS record.
Any activities conducted in a manner consistent with this policy will be
considered authorized conduct and we will not initiate legal action against
you. If legal action is initiated by a third party against you in connection
with activities conducted under this policy, we will take steps to make it
known that your actions were conducted in compliance with this policy.
Thank you for helping keep Worklytics and our users safe!
This program have been found on Hackerone on 2019-10-22.