Security and Vulnerability Disclosure

Nonprofits trust Bless Events with their supporters' names, addresses, gifts and payment details. If you find a security problem in the Service, we want to hear about it. This page explains how to tell us and how to test without putting anyone's data at risk.

How to report a problem

Email security email.

It helps if you include:

• what the problem is and why it matters;
• the web address, page or feature where you found it;
• step-by-step instructions to reproduce it;
• any proof of concept, screenshots or logs, with other people's personal data removed;
• your name or handle, and how to reach you, if you want us to follow up or credit you.

Please write in English if you can. Please do not share the problem with anyone else until we have fixed it, or until we have agreed with you on when to share it.

We also publish our security contact at /.well-known/security.txt.

What we ask of you

When you look for or test a security problem, please:

• only test against an organization account you created yourself for testing;
• use Stripe test mode on that account. Never make, refund or dispute a real payment, and never use a real card that is not yours;
• stop as soon as you have shown the problem exists. If you reach data that belongs to another organization or another person, look at no more than you need to prove it, do not keep or share it, and tell us in your report;
• not change or delete data that is not yours;
• not try to get into another person's login or another organization's account, other than the minimum needed to prove the problem;
• give us a reasonable time to fix the problem before you share it with anyone.

Out of scope

Please do not:

• use social engineering, phishing or pretexting against our staff, the organizations that use Bless Events, or their supporters;
• attack our offices, staff or anyone's physical property;
• run denial-of-service attacks, load tests or anything else that slows the Service or makes it unavailable;
• send spam or bulk email through the Service;
• run automated scanners that send large numbers of requests;
• test the services we rely on, such as Stripe, Resend, PostHog or our hosting provider. Report problems in their services to them, under their own programs;
• test against live payments or real supporters' data.

We are less interested in reports that show no real risk, such as missing security headers on their own, banner or version disclosure, or rate limits on pages that hold no personal data. You are still welcome to send them.

Safe harbor

If you make a good-faith effort to follow this policy, we will consider your research authorized. We will not take legal action against you, or ask law enforcement to act against you, for that research. If someone else takes legal action against you for research that followed this policy, we will make it known that your research was authorized by us.

This does not authorize you to break any law, or to access, keep or share data beyond what this policy allows. If you are not sure whether something you plan to do follows this policy, ask us at security email before you do it.

What we do when we get your report

• We will confirm that we received your report.
• We will look into it and tell you whether we could reproduce it.
• We will keep you updated while we work on a fix, and tell you when it is fixed.
• If you want, we will credit you by name or handle once the problem is fixed.

We fix the most serious problems first. How long a fix takes depends on the problem, so we do not promise a fixed time. If the problem exposed an organization's data, we will tell that organization as our Data Processing Addendum requires.

No paid bounty

We do not run a paid bug bounty program, and we do not pay for reports. We are grateful for them all the same.

Changes to this policy

We may update this policy. The date at the top shows when it last changed.