Security | GiveSendGo

GiveSendGo Vulnerability Disclosure Policy

Effective Date: April 16, 2025

Introduction

At GiveSendGo, the security of our users and platform is a top priority. We welcome responsible disclosure from ethical hackers, security researchers, and the broader community who help us identify vulnerabilities before they can be exploited.

This Vulnerability Disclosure Policy outlines how to responsibly report security issues and what you can expect from us in return. By following this policy, you help us create a safer experience for everyone.

Our Commitment to You

If you act in good faith and adhere to the guidelines below:

We will not pursue legal action against you.
We will work to triage and remediate reported vulnerabilities promptly.
We will respect your responsible efforts and treat your submission with professionalism.
We may, at our sole discretion, offer public acknowledgment or a token of appreciation for high-impact, valid reports.

Reporting Guidelines

To submit a vulnerability report:

Email us at security@givesendgo.com with a detailed description of the issue.
Include reproduction steps, proof-of-concept (PoC) code, affected endpoints or systems, and a clear assessment of the security impact.
If applicable, include any relevant screenshots, logs, or data samples.

Note:

GiveSendGo does not operate a public bug bounty program. Submissions do not guarantee any form of reward, payment, or acknowledgment.

What to Expect After You Report

You will receive an automated confirmation that your report has been received.
Our team will review and triage your submission.
If the report is valid, original, and demonstrates significant impact, we will reach out for further information or to confirm a fix.
If the report is a duplicate, known issue, or deemed low-risk, we may not respond further.

We prioritize quality over quantity and cannot provide updates or feedback on all submissions.

What Not to Do

Please do not:

Submit exaggerated or intentionally inflated severity ratings.
Attempt to access, modify, or delete data belonging to others during testing.
Engage in social engineering, phishing, denial of service (DoS), or physical attacks.
Contact other departments (e.g., customer service) about your report.
Send repeated follow-up emails or messages through other channels.

All communication should go through security@givesendgo.com. If your report meets our criteria, we will follow up with you.

In-Scope Assets

We currently accept reports for:

https://www.givesendgo.com and all subdomains
Official GiveSendGo mobile applications

Note:

Reports involving clickjacking on non-authenticated pages, missing headers without exploitability, or automated scanner output without proof-of-concept are considered out-of-scope.

Legal Expectations

GiveSendGo supports responsible security research and values contributions from the security community.

If you act in good faith, avoid data exposure, and follow this policy:

We will treat your research as a legitimate effort to improve platform security.
We will not initiate legal action solely based on your responsible disclosure.

Note: We reserve the right to take action in cases of data theft, service disruption, or malicious activity.

Final Notes

We appreciate the contributions of the security research community and strive to maintain a safe and secure platform for all. By submitting a report, you agree to this policy and acknowledge that GiveSendGo retains sole discretion over how reports are triaged, resolved, and recognized.

Thank you for helping us make GiveSendGo safer.