Responsible disclosure
Found a security problem? Report it and we will fix it without taking you to court.
Reporting
Send your report to [email protected]. Describe what you found, how we can reproduce it, and what you think the impact is. A screenshot or a short script helps. Do not publish anything before the issue is fixed.
What we do
- We confirm your report within three working days.
- Within ten working days we tell you what we will do and by when.
- We keep you posted until it is resolved, and credit you by name if you want that.
- We will not report you to the police or start proceedings if you keep to the rules below.
Rules
- Stay away from other people's data. If you do reach personal data, stop at once and say so in your report.
- No denial of service, no spam, no social engineering of staff or users, and no physical access attempts.
- Change or delete nothing, and leave no backdoor. Use as few requests as possible to demonstrate the issue.
- Do not use a vulnerability to bulk-download or redistribute study material.
What we care about most
- Access to an account or to book content without a valid subscription.
- Circumventing the device limit or the watermark.
- Any endpoint that allows content to be retrieved in bulk.
Reward
We run no paid bug bounty. For a serious report we offer credit and a free year of the subscription.