Scope
In scope:
- shopassist.coec.dk, including the dashboard, the Shopify embedded app and the docs
- api.shopassist.coec.dk and cdn.shopassist.coec.dk
- The chat widget and the ShopAssist plugins for Shopify, Magento 2, WooCommerce and PrestaShop
Out of scope: denial-of-service tests, social engineering, physical attacks, reports from automated scanners without a demonstrated impact, and merchants' own stores.
How to report
Email security@coec.dk with a description, the steps to reproduce and the impact. Please do not access, change or delete other people's data. Use test accounts, and stop as soon as you have shown the issue.
Safe harbour
If you act in good faith under this policy, we will not take legal action against you and will not ask others to. If a third party does, we will make it known that you acted under this policy.
Our response
- Acknowledgement within 3 business days.
- A first assessment within 10 business days.
- We keep you updated until the issue is fixed, and credit you if you want.
There is no bug bounty in v1.