Security and responsible disclosure
If you believe you have found a security vulnerability in CIQRA, please tell us privately first. This page
explains how to do that and what happens next. The same address is published in our
security.txt (RFC 9116).
Reporting a vulnerability
Section titled “Reporting a vulnerability”Email [email protected]. Please include:
- what you found and where (URL, endpoint or component);
- steps to reproduce it;
- the impact you believe it has; and
- how we can reach you.
You can write in English or Turkish. You do not need to give your real name, but we cannot credit you or reply if you give no contact details. Do not put live secrets, tokens or a merchant’s customer data in the report: tell us what kind of data it was and where. We will rotate the secret; we do not need a copy.
In scope:
- The CIQRA platform API (
api.ciqra.com), sign-in (id.ciqra.com), the merchant admin (admin.ciqra.com) and the App API documented on this site. - Storefronts on
*.myciqra.com, only on a store or developer store you created yourself for testing. - App platform behaviour: OAuth and app tokens, scopes, webhook signatures, partner URL handling.
- Theme and template rendering (Liquid): sandbox escapes, resource exhaustion, cross-tenant reads.
Out of scope, unless you can show a concrete security impact:
- a merchant’s own connected domain (for example
www.example-shop.com): it belongs to that merchant; - vulnerabilities in third-party apps and services we integrate with: please report these to the vendor;
- missing security headers, or missing best-practice settings, with no demonstrated exploit;
- reports produced only by automated scanners;
- clickjacking on pages that perform no sensitive action;
- SPF, DKIM or DMARC settings on domains that do not send mail;
- issues that only affect outdated or unsupported browsers, or that need a rooted device or a victim who already gave away their password.
Safe harbour
Section titled “Safe harbour”When you research and report a vulnerability in line with this policy, we will:
- consider your research authorised for the purposes of our own terms of service and acceptable use policy, and waive any claim we have under them about that research;
- not bring legal action against you, and not report you to law enforcement, for that research;
- if a third party brings legal action against you, or a complaint, about research that complied with this policy, make it known that you acted with our authorisation under this policy, where the law allows; and
- work with you to understand and fix the issue, and, if you wish, credit you publicly once it is fixed.
We cannot authorise testing of systems that we do not own or control, including other merchants’ data and third-party services such as payment providers. We cannot bind public authorities either. If you are unsure whether something is in scope, ask us at [email protected] before testing.
Conditions
Section titled “Conditions”This safe harbour applies only if you:
- Test only what you are allowed to. This means CIQRA’s own services, and stores or developer stores that you created yourself. Do not access, change or delete data that belongs to another merchant or to their customers.
- Take the minimum. If you reach personal data or other confidential data, stop at once. Do not copy, download or keep more than is needed to show the vulnerability; a single record or a redacted screenshot is enough. Do not use the data, share it or try to access more. Delete everything you hold once you have reported it, and confirm the deletion to us.
- Do not degrade the service. Do not run denial-of-service tests or load tests, high-volume automated scans, or anything that could harm the availability or integrity of the platform or of merchants’ stores. Do not make real purchases, refunds, payouts or payment-card transactions; use test-mode payment methods.
- Do not use social engineering or physical attacks. This rules out phishing, vishing or pretexting aimed at CIQRA staff, merchants or their customers, and any attempt to gain physical access to offices or data centres. Do not send spam or unsolicited messages through the platform.
- Report promptly. Report the vulnerability to us without undue delay after you find it, and do not exploit it further than is needed to confirm it.
- Give us time. Do not disclose the vulnerability publicly, or to anyone else, until we have fixed it or until 90 days have passed since your report, whichever comes first, unless we agree a different date with you. If the issue is being actively exploited, we may agree a shorter period with you.
- Act in good faith. Do not demand payment or anything else in return for not disclosing, and do not use a vulnerability for any purpose other than reporting it to us.
If you accidentally break one of these conditions, tell us at once. We will take that into account.
What we aim for
Section titled “What we aim for”These are our aims, not guarantees. Business days are days other than Saturday, Sunday or an Estonian public holiday.
| Step | Our aim |
|---|---|
| First response (we confirm we have your report and tell you who is handling it) | within 3 business days |
| Triage (we confirm or reject the issue, assess its severity and tell you the next steps) | within 10 business days |
| Fix for a critical vulnerability | within 30 days of triage |
| Fix for other vulnerabilities | according to severity; we will tell you our plan at triage |
We will keep you updated while we work on the issue, and we will tell you when it is fixed.
Disclosure
Section titled “Disclosure”Please keep to condition 6 above. Once a fix is live we are happy to coordinate a public write-up and to credit you if you wish.
Rewards
Section titled “Rewards”We do not currently run a paid bug bounty programme.