How to report a security vulnerability

Found something that looks like a security problem in SOPCompass, the capture extension, the API or sopcompass.com? Please tell us privately.

How to tell us

Email support@ironbridgeaiadvisory.com with “Security” in the subject line. This is the same contact published on our security page. Please include:

• what you found and why you think it is a vulnerability,
• the steps to reproduce it, including URLs, requests and the role you were signed in as,
• what an attacker could do with it, and
• how to reach you.

Please don’t

• access, change or delete data that isn’t yours, beyond the minimum needed to show the problem,
• test against workspaces you aren’t a member of,
• run denial of service, spam or high volume automated scans,
• try social engineering or phishing against anyone, or
• share the issue publicly before it is fixed.

The safest way to test is in a workspace you created yourself.

What to expect

We will read your email, look into the issue, and reply with what we found and what we are doing about it. There is no paid bug bounty.

Known behavior that isn’t a vulnerability

• Images and videos can be opened by anyone with their exact long, random address. That is how SOP media is served today, and it is documented in Files and storage access.
• A share link can be read by anyone who has it. That is its purpose.
• Multi-factor authentication and SAML SSO aren’t available yet, as stated in Sign-in and authentication.