VULNERABILITY DISCLOSURE POLICY

Report a vulnerability

The safety and security of our customers’ data and the user experience of our service are important to us. That is why we aim to design, develop, and create products to the highest levels of security and reliability. Despite our best efforts, vulnerabilities and errors may still be present, due to the complexity of our service.

This policy describes Smallest Inc.’s approach to receiving reports about potential vulnerabilities and errors in our products and services.

Customers, users, researchers, partners, and any other person who uses our services are encouraged to report any such issues they experience by using the Report a vulnerability form on our trust page.

Smallest Inc. appreciates the identification and reporting of any vulnerabilities and errors, as these efforts contribute to improving the security and reliability of our products and services.

Please note that providing your contact information with your report is entirely voluntary and at your discretion. We will access and utilise all reports provided — whether submitted anonymously or with contact information. If you submit your contact information, we will only use your information to get in touch with you regarding the details of your report, if necessary. Please visit our Privacy Policy for more information on how we collect and use data.

By sharing a report regarding vulnerabilities and errors using the report form or any other means, you agree to the following terms:

Smallest Inc. may use your report for any purpose deemed relevant, including without limitation, for the purpose of correcting any vulnerabilities reported.
By proposing any changes and/or improvements to Smallest Inc.’s products or services in your report, you give Smallest Inc. all use and ownership rights to such proposals.

In addition, you confirm the following:

You have not, and will not exploit or use in any manner (other than for the purposes of reporting to Smallest Inc.), the discovered vulnerabilities and/or errors.
You have not engaged, and will not engage, in the testing/research of systems with the intention of harming Smallest Inc., its customers, employees, partners or suppliers.
You have not used, and will not use, misuse, delete, alter or destroy any Smallest Inc. data that you have accessed or may be able to access related to the vulnerability and/or error discovered.
You have not conducted, and will not conduct, social engineering, spamming, phishing, denial-of-service or resource-exhaustion attacks against Smallest Inc..
You have not tested, and will not test, the physical security of any property, building, plant or factory associated with Smallest Inc..
You have not breached, and will not breach, any applicable laws in connection with your report and interaction with Smallest Inc.’s products or services.
You agree not to disclose to third parties any information related to your report, the vulnerabilities and/or errors reported, nor the fact that any vulnerabilities and/or errors have been reported to Smallest Inc..
Smallest Inc. does not guarantee that you will receive any response related to your report.
Smallest Inc. will only contact you regarding your report if deemed necessary.
You agree that you are making your report without any expectation or requirement of reward or other benefit, financial or otherwise, and without any expectation or requirement that the vulnerabilities and/or errors reported will be corrected by Smallest Inc..