Sparkwise (operated by People Renaissance, Inc.) is committed to protecting our platform and the data our clients trust us with. If you believe you've found a security vulnerability in a Sparkwise system, we want to hear from you.
This policy explains which systems and types of research are covered, how to report a vulnerability to us, what we ask of you, and what you can expect from us in return.
Authorization
If you make a good-faith effort to follow this policy during your research, we will consider that research authorized. Specifically, we will:
- Not pursue or support legal action against you related to your research.
- Work with you to understand and resolve the issue quickly.
- If a third party takes legal action against you for activity that followed this policy, make it known that your research was authorized by us.
This authorization covers Sparkwise systems only. We can't authorize testing of systems owned by other companies (see Scope).
If you're unsure whether something you plan to do is consistent with this policy, email us at [email protected] before going further.
Scope
In scope
- sparkwise.co and its subdomains (*.sparkwise.co), including:
- app.sparkwise.co (the Sparkwise platform)
- admin.sparkwise.co (the administrator dashboard)
- scheduling.sparkwise.co (scheduling and signup forms)
- api.sparkwise.co (the Sparkwise API)
- architect.sparkwise.co (Architect, our authoring tool)
- builder.sparkwise.co (Program Builder)
- The APIs, websockets, and background services used by these applications
If you come across a system that appears to be operated by Sparkwise but is not listed above, please report it to us rather than testing it. We will tell you whether it is covered.
Third-party services
Some parts of our footprint run on vendor platforms. Examples include our marketing website at sparkwise.co, media delivery, product analytics, real-time collaboration, and video conferencing. Vulnerabilities in a vendor's own platform are outside this policy and should be reported to that vendor under their disclosure policy.
However, problems in how we have configured those services are in scope, and we want to hear about them. Examples include a subdomain takeover, a dangling DNS record, or a setting in one of our accounts that exposes data.
Client single sign-on
Some clients sign in to Sparkwise through their own identity provider, using a dedicated entry point under sso.sparkwise.co. Those entry points and the way Sparkwise handles the sign-in are in scope. The client's identity provider, directory, and user-provisioning systems are not. Do not test against them.
Out of scope
- Non-production, staging, and preview environments
- Platforms operated by our vendors, clients, partners, or integration providers
- Client identity providers and directories
- Email services for the sparkwise.co domain
- Sparkwise employees, offices, and physical facilities
Test accounts
Sparkwise does not offer self-service signup. If you need an account to test with, email [email protected] and we will provision one for you. Please do not use our trial request, session signup, or scheduling forms for testing, as these start real workflows for our team and clients.
Guidelines
When conducting research, please:
- Report promptly. Notify us as soon as possible after you discover a real or potential security issue.
- Use only your own accounts. Only use accounts you own or that we have provided to you. Do not access, modify, or delete data belonging to other users or organizations.
- Stop when you've shown the issue. Do only what's necessary to demonstrate the vulnerability. If you encounter personal data, credentials, or other sensitive information, stop, don't save or share it, and tell us in your report.
- Don't disrupt the service. Keep automated testing to a modest rate, and avoid anything that degrades the platform for other users. Our edge and application firewalls rate-limit and block aggressive traffic. Being blocked is expected behavior, not a finding.
- Keep it confidential. Don't share details of the vulnerability with others until it's resolved or the disclosure timeline below has passed.
Test methods that are not permitted
- Denial-of-service or resource-exhaustion testing
- Social engineering of Sparkwise staff, clients, or partners, including phishing, phone calls, and pretexting
- Physical testing of offices, equipment, or facilities
- Sending messages, invitations, calendar events, or notifications to people who haven't agreed to receive them
- Installing persistent access, moving into other systems, or taking more data than the minimum needed to demonstrate the issue
- Testing any system listed as out of scope
Findings we generally don't accept
Unless you can demonstrate a concrete security impact, we generally don't accept reports of:
- Missing security headers or cookie flags
- SPF, DKIM, or DMARC configuration
- Clickjacking on pages with no sensitive actions
- Self-XSS, or issues that require physical access to a victim's unlocked device
- CSRF on logout or on unauthenticated forms
- Missing rate limiting on non-sensitive endpoints
- Rate limiting or firewall blocks encountered during testing
- Software version disclosure or verbose error messages that reveal no sensitive data
- Content spoofing or text injection without a realistic attack
- Unvalidated output from automated scanners
- Prompt injection, jailbreaks, or objectionable output from AI features, unless it exposes another user's data or lets someone perform actions they aren't authorized to perform
- Issues affecting only outdated or unsupported browsers
How to report a vulnerability
Email [email protected] and include:
- The affected URL, subdomain, or feature
- A description of the vulnerability and its potential impact
- Steps to reproduce it (proof-of-concept code, screenshots, or a short video are very helpful)
- How you'd like to be credited, if at all
You may report anonymously. Please use this address rather than support chat or the help center so your report goes straight to the people who handle security issues.
What you can expect from us
When you report a vulnerability in line with this policy, we will:
- Acknowledge your report within 3 business days.
- Give you an initial assessment within 10 business days, including whether we've been able to confirm the issue.
- Keep you informed as we work on a fix, and let you know when it's resolved.
- Acknowledge your contribution publicly once the issue is fixed, if you'd like us to.
Disclosure
We ask that you give us 90 days from your report to resolve the issue before disclosing it publicly. If we need more time, we'll explain why and agree on a timeline with you. If we fix the issue sooner, we're happy to coordinate an earlier disclosure. Please share what you plan to publish with us before you do.
Rewards
Sparkwise does not currently run a bug bounty program and does not pay for vulnerability reports. We won't agree to payment as a condition of receiving a report's details. We are grateful to everyone who helps keep our users safe, and we're happy to recognize your contribution as described above.
Questions
Questions about this policy, or about whether something is covered, can be sent to [email protected]. This policy is also referenced from our security.txt file at sparkwise.co/.well-known/security.txt. We may update this policy from time to time; the date at the top shows when it last changed.