Reporting a security issue

If you think you have found a weakness in Clock Clerk, we want to hear about it.

How to report it

Use the contact form, with the security reason chosen. Your report reaches the people who run the service and is given a reference, which our replies quote. Tell us:

• what you found, and what someone could do with it;
• where: the address, the screen or the request;
• the steps that show it, with the organization you tested in.

What we do

We confirm we have your report, look into it, keep you told as we work on it, and tell you when it is fixed.

While you look

• Test only in an organization of your own, such as a free trial. Never read, change or delete anyone else's data. If you come across some, stop, and tell us what you saw.
• Leave out anything that slows the service for others, such as denial-of-service, load or spam tests, and do not try to trick our customers or us into giving anything away.
• Keep the issue to yourself until we have fixed it, or until we have agreed a date with you.

For tools

The same details are published at /.well-known/security.txt on clockclerk.com and app.clockclerk.com.