Report a vulnerability

We welcome reports from security researchers. If you think you've found a vulnerability in Gatehouse, the hosted service or usegatehouse.com, please tell us.

#How to report

Email security@usegatehouse.com with:

• what you found and where,
• steps to reproduce it, and
• the impact you believe it has.

Please don't include real customer data in your report.

#What we ask

• Give us reasonable time to fix the issue before you disclose it publicly. We aim for 90 days or less.
• Test only against accounts you own, or a self-hosted copy of Gatehouse.
• Don't access, change or delete data that isn't yours. Don't degrade the service for others (no denial of service, spam or social engineering).

#What you can expect

• An acknowledgement within 3 business days.
• An initial assessment within 10 business days.
• Updates until the issue is fixed, and credit in the release notes if you'd like it.

If you follow this policy, we won't pursue legal action against you for your research, and we'll consider your activity authorized.

Our machine-readable contact details are at /.well-known/security.txt.