Responsible Disclosure

Security is a top priority for us at Primer and we work hard to make sure our systems are secure, but we’re human and might miss something. To help keep our users safe, we want to collaborate with external Security Researchers and Bug Hunters.

Here’s a guideline of how you can report vulnerabilities, and what you can expect from us if you do.

All reports can be sent to security@primer.io. If you would like to encrypt your mail (we suggest you do if it contains personal information), please find our PGP key at the bottom of this page.

Do’s

✅ Send reports even if you’re not certain about the vulnerability. Better safe than sorry!

✅ Make sure the report is in well-written English

✅ Include any evidence or proof-of-concepts that might help us reproduce and diagnose the vulnerability faster

✅ Minimise harm to production systems, and tell us early! If you notice degradation to the performance of the system you’re testing, please pause and let us know!

Don’ts

❌ Don’t attempt to Social Engineer Primer employees or our users

❌ Don’t exploit a vulnerability to gain access to data or modify systems in ways that might affect our users

❌ Don’t post anything on blogs or social media until we’ve been able to triage and repair the vulnerability. Our goal is to minimize any harm to our users, but we’re happy for you to make your work public—only after the fact and once we’ve given you the go-ahead.

❌ Don’t attempt attacks or submit reports for vulnerabilities within the following categories:

Social engineering against Primer employees or users
Missing security best practices such as HSTS, cookie Secure/HTTPOnly, DNSSEC, or insecure SSL/TLS configurations (unless a realistic attack can be demonstrated)
Public knowledge (non-zeroday) CVEs
Intentional open redirects (e.g. standard OAuth flows)
Missing CAPTCHA, weak validation (including password policies), or CSRF on forms that allow anonymous submission
Tabnapping, clickjacking, self-XSS (unless a realistic attack can be demonstrated) or attacks that require victims to take steps to become vulnerable

Our Part

We take submissions seriously, and we’ll let you know when we: begin investigation of your submission, reach a conclusion, and deploy fixes.

Here are the timelines you can expect:

Initial acknowledgement and response: 3 business days
Confirmation (and expected date of fix deployment): 5 business days

In return for following these guidelines, we offer the following:

✅ Safe harbour: we will not take legal or punitive action against you, including those from accidental damage to our systems during testing.

✅ Privacy and Confidentiality: we don’t take this lightly, and will never disclose or publicise any information without your explicit consent

✅ Recognition via the Hall-of-Fame hosted at https://primer.io/security/famous.txt

Thanks for keeping an eye out. Happy hunting!

Key ID: 3BFC42E548A5A06657452A42BA0C6B013C259DC9

Public Key: