Introduction
SS8 Productions is a photography and video business in Terrace, British Columbia. Clients entrust us with their photographs and some personal information, and we are responsible for protecting both.
We welcome reports from security researchers and members of the public who identify a vulnerability in our systems. This policy sets out how to report a vulnerability, which testing is acceptable, and what you can expect from us.
Scope
This policy applies to:
- www.ss8productions.com
- the SS8 client portal
- the SS8 administrator sign-in pages
The following are out of scope:
- Services operated by third parties, including Stripe, Google and Cloudflare. Please report vulnerabilities in those services to their operators.
- Social media accounts
- Physical premises, equipment and vehicles
- Social engineering or phishing directed at our staff or clients
- Denial of service, spam, and automated scanning that degrades the website
- Reports of missing best practices (for example, a missing security header) that come with no demonstrated, exploitable impact
How to report
Send your report to admin@ss8productions.com with the subject line "Security report". Please include:
- a description of the vulnerability and its location (a URL or the affected feature)
- the steps required to reproduce it
- the potential impact, as you understand it
- optionally, the name or alias you would like us to use if we acknowledge your contribution
Reports may be submitted anonymously. Please do not attach client photographs, credentials or other personal information. A clear description is sufficient.
Testing guidelines
When conducting research under this policy, you must:
- Use only the access needed to demonstrate that the vulnerability exists.
- Not view, modify, copy or delete client photographs or client information beyond that minimum.
- Stop testing and notify us immediately if you encounter personal information, and not share it.
- Not disrupt our services or affect other users.
- Not use social engineering, physical access, or denial of service.
- Securely delete any data obtained during testing once you have reported the issue.
- Not request payment in exchange for a report or for silence.
- Not disclose the vulnerability publicly or to third parties until we have resolved it, or 90 days after we acknowledge your report, whichever is earlier. We may ask to extend this period; please contact us before any earlier disclosure.
Good-faith safe harbour
We consider research that is conducted in good faith and in accordance with this policy to be authorized. We will not pursue civil action against you, and we will not ask law enforcement to investigate you, for that research.
This protection has limits. It applies only to claims within the control of SS8 Productions. It does not bind third parties or public authorities, and it does not alter the law, including section 342.1 of the Criminal Code of Canada. We may withdraw it from anyone who does not follow this policy. If you are unsure whether an activity is covered, contact us before proceeding.
What to expect from us
- We will acknowledge your report within 5 business days.
- We will review it and let you know what we found, and we aim to do this within 10 business days of acknowledgement.
- We will keep you informed of our progress until the issue is resolved.
- We will coordinate with you on the timing of any public disclosure.
Recognition
SS8 Productions does not operate a paid bounty program and does not pay rewards for vulnerability reports. With your permission, we will acknowledge your contribution by name or alias once the issue is resolved.
Privacy of reporter information
We collect the personal information you provide in a report (such as your name and email address) only to assess the report, communicate with you and, with your permission, acknowledge your contribution. We protect it as required by British Columbia's Personal Information Protection Act and, where it applies, the federal Personal Information Protection and Electronic Documents Act. We will not share your name or contact information outside SS8 Productions without your express permission, except where the law requires it.
Policy updates
We may update this policy from time to time. The date at the top of this page shows when it was last changed.