Keeping UXPin and our customers' data secure is important to us. If you've found a security vulnerability, we want to hear about it.
How to report
Send your report to security@uxpin.com. Please include:
- a description of the issue and its potential impact
- steps to reproduce, including affected URLs
- any proof of concept (screenshots, requests, video)
What to expect
We'll acknowledge your report within 5 business days. We'll review it, keep you updated if we need more information, and let you know once the issue is resolved.
No bug bounty
UXPin does not run a paid bug bounty program, and we don't offer financial rewards for reports. By submitting a report, you agree to the terms of this policy. Requests for payment, or reports conditional on payment, will not receive a reply.
If your report is valid and you'd like to be credited, let us know in your report and include the name or nickname you'd like us to use. You can also add a link (for example your website or social profile). We'll add you to the Acknowledgments section on this page.
Scope
In scope:
- *.uxpin.com services owned and operated by UXPin, including app.uxpin.com
- UXPin Mirror for iOS and Android
Out of scope:
- UXPin desktop apps for Mac and Windows
- staging, development, and test environments
- services hosted by third parties (for example our blog, help center, or marketing tools). Please report issues with those directly to the provider.
- denial of service or load testing
- social engineering or phishing of UXPin employees or customers
- physical attacks
- findings without a demonstrated security impact, such as missing headers, SPF/DMARC configuration, or clickjacking on pages without sensitive actions
- reports generated by automated scanners without verification
Rules of engagement
- only test against accounts you own or have permission to use
- don't access, modify, or delete other users' data
- stop testing and report as soon as you confirm an issue
- give us reasonable time to fix the issue before sharing it publicly
Acknowledgments
We'll list researchers who reported valid issues here.