---
title: "Reporting a security issue — Clock Clerk"
description: "How to tell Vayner Systems about a weakness in Clock Clerk, what to include, what not to test, and what happens next."
url: "https://clockclerk.com/security"
---

# Reporting a security issue

If you think you have found a weakness in Clock Clerk, we want to hear about it.

## How to report it

Use [the contact form](https://app.clockclerk.com/contact?reason=security-report), with the security reason chosen. Your report reaches the people who run the service and is given a reference, which our replies quote. Tell us:

- what you found, and what someone could do with it;
- where: the address, the screen or the request;
- the steps that show it, with the organization you tested in.

## What we do

We confirm we have your report, look into it, keep you told as we work on it, and tell you when it is fixed.

## While you look

- Test only in an organization of your own, such as a free trial. Never read, change or delete anyone else's data. If you come across some, stop, and tell us what you saw.
- Leave out anything that slows the service for others, such as denial-of-service, load or spam tests, and do not try to trick our customers or us into giving anything away.
- Keep the issue to yourself until we have fixed it, or until we have agreed a date with you.

## For tools

The same details are published at `/.well-known/security.txt` on clockclerk.com and app.clockclerk.com.