Found a weakness?
Help us make it right.

Callgoose places utmost importance on security vulnerabilities and concerns. We actively encourage our users and members of the security community to responsibly and confidentially report potential vulnerabilities and incidents to us. This proactive approach enables us to swiftly address and rectify such issues.

• Given the confidential nature of this program, we kindly request that participants refrain from discussing the program or any vulnerabilities, even once resolved, outside the program framework without express consent from Callgoose.
• Participants are also expected to adhere to the standard vulnerability disclosure guidelines.

To ensure effective vulnerability assessment and resolution, we have established specific rules for participants:

• Detailed Reports: Please provide comprehensive reports that include reproducible steps. Reports lacking sufficient detail for issue replication may not be marked as triaged.
• Single Vulnerability per Report: Submit one vulnerability per report, unless the nature of the vulnerabilities requires their chaining to demonstrate impact.
• Duplicate Reports: In the case of duplicate reports, we will only triage the first received report that can be fully reproduced.
• Multiple Vulnerabilities: Multiple vulnerabilities stemming from a single underlying issue will be considered as one valid report.
• Prohibited Activities: Social engineering activities, such as phishing, vishing, and smishing, are strictly prohibited. Additionally, participants are expected to make a good-faith effort to avoid privacy breaches, data destruction, and disruption or degradation of our services. Interaction with accounts should only occur with the account owner's explicit permission.

When reporting vulnerabilities, participants should consider the potential attack scenarios and the security impact of the identified bug. The following issues are deemed out of scope for this program:

• Clickjacking on pages with no sensitive actions.
• Cross-Site Request Forgery (CSRF) on unauthenticated forms or forms with no sensitive actions.
• Attacks requiring Man-in-the-Middle (MITM) or physical access to a user's device.
• Vulnerabilities related to previously known vulnerable libraries without a functioning Proof of Concept.
• Comma Separated Values (CSV) injection, unless the vulnerability is demonstrated.
• SSL/TLS configuration issues not following best practices.
• Activities potentially leading to service disruption (Denial of Service - DoS).
• Content spoofing and text injection issues lacking an attack vector or the ability to modify HTML/CSS.
• Rate limiting or brute-force issues on non-authentication endpoints.
• Inadequate practices in Content Security Policy.
• Missing HttpOnly or Secure flags on cookies.
• Violations of email best practices (e.g., invalid, incomplete, or missing SPF/DKIM/DMARC records).
• Vulnerabilities limited to users of outdated or unpatched browsers (less than 2 stable versions behind the latest release).
• Rate limiting on login pages (Please consult our Developer Documentation for information on rate limits on other endpoints to avoid reporting expected behavior).
• Software version disclosure, banner identification issues, or descriptive error messages/headers (e.g., stack traces, application or server errors).
• Tabnabbing.
• Open redirects, unless an additional security impact can be demonstrated.
• Issues necessitating unlikely user interaction.

Please note that this list is not exhaustive; it represents the most common scenarios. The absence of an issue on this list does not automatically categorize it as a valid submission.

Prior to engaging in any activity, kindly contact us to obtain approval pertaining to said activities. Pre-approved activities conducted in adherence to this policy are considered authorized conduct, and Callgoose will refrain from initiating legal action against individuals engaged in such activities. In the event that third-party legal action is pursued against you concerning activities carried out under this policy within our products and services, we will make efforts to acknowledge that your actions were conducted in compliance with this policy.

We sincerely appreciate the efforts of individuals who identify security issues and commend responsible disclosure practices. Thank you for collaborating with us to enhance our security posture.

To submit your vulnerability report, kindly forward the pertinent details through our designated communication channel, Contact Us

We kindly request that you furnish as much information as possible concerning the potential issue you have identified. Your comprehensive report will expedite the validation process, enabling us to promptly assess the matter. Your cooperation in this regard is greatly appreciated.