Reporting a security problem
If you have found a weakness in the CommonBeat app, this website or anything behind them, thank you for looking. Please tell us before you tell anybody else.
How to report it
Write to info@commonbeat.ca. A person reads every message sent there.
Plain text is fine, and so is a rough note. You do not need a CommonBeat account to write to us.
What to put in it
Whatever you have is welcome. These help us most:
- What you found, and where: the page, the screen in the app, or the address it lives at.
- The steps that show it, in order, so that we can see it for ourselves.
- What you think somebody could do with it.
- How to reach you, if it is not the address you are writing from.
If you saw anybody else's information along the way, tell us that you did, and do not send it to us.
What happens next
A person reads your report and replies by email within 3 business days. That is the promise the safety page makes for every message, and it is the same here.
A reply means we have read it and started. It does not mean it is fixed.
We will tell you what we decided, and, if it needs fixing, when the fix is out. Please keep it between us until then.
CommonBeat is operated by one person, so a fix may take longer than it would at a large company. If it does, we will say so rather than go quiet.
Research in good faith
We will not take legal action against you, or ask anybody else to, for research that follows this page in good faith.
Good faith here means:
- You test only your own account, or accounts you made for testing.
- You do not open, copy, change or delete anybody else's information. If you reach some by accident, stop there, tell us, and do not keep it.
- You do not try to take the service down, flood it with requests, or send codes or messages to phone numbers that are not yours.
- You do not trick or pressure members, or us, into anything.
- You give us a fair chance to fix it before you tell anybody else.
No paid bounty yet
CommonBeat does not pay for reports at this stage. It is a small company without the budget for one, and we would rather say so than leave you guessing. We are grateful for every report all the same.
If it is about a person, not the software
This address is for weaknesses in the software. If you are worried about somebody, use the report button in the app. If somebody is in danger now, call 911 first.