We want Starhive to be safe for everyone who uses it. If you find a security vulnerability in Starhive, please tell us, and give us the chance to fix it before anyone else finds out. This policy says how to report it, what to test, and what we promise in return.
How to report a vulnerability
Email support@starhive.com with “Security vulnerability” in the subject. Please include:
- what you found, and where (the URL, endpoint or part of the product);
- the steps to reproduce it, and any proof of concept;
- what an attacker could do with it;
- how to reach you, if you'd like us to.
Write in English or Swedish. Please don't share the details anywhere else until we've fixed the issue.
What's in scope
- starhive.com, including its forms and site search;
- the Starhive application at app.starhive.com, and the sites and portals built with it;
- Starhive's API and MCP server at api.starhive.com;
- Starhive's documentation at docs.starhive.com;
- Starhive's integrations, such as the Starhive app for Slack.
What's out of scope
- services run by other companies, even when Starhive uses them (such as status.starhive.com, or the sub-processors listed in our Data Processing Addendum): please report those to their owners;
- denial of service, load testing and spam;
- social engineering or phishing of Starhive's staff or customers, and physical attacks;
- reports from automated scanners without a way to exploit what they found;
- missing best practices with no security impact of their own, such as a missing header or an email record.
How to test
- Test only with accounts and workspaces of your own. You can start a free trial for that.
- Never access, change or delete other people's data. If you come across any, stop, don't keep a copy, and tell us in your report.
- Do only what's needed to show the vulnerability, and don't disrupt Starhive for others.
- Give us reasonable time to fix the issue before you publish anything about it. We'll agree on a date with you.
Testing within this policy counts as a security assessment we permit under our Acceptable Use Policy.
What we promise
- We confirm we got your report, and tell you what we'll do about it.
- We keep you up to date while we work on a fix, and tell you when it's fixed.
- We won't take legal action against you, or ask anyone else to, for research done in good faith within this policy.
- With your permission, we credit you when we announce the fix.
We don't run a paid bug bounty program.