Responsible disclosure
Found a security problem? Tell us before anyone else finds out the hard way.
We take reports from outside researchers seriously and would rather hear from you directly than find a write-up after the fact. This page sets out what's in scope, how to report, and what you can expect back.
Scope
What this policy covers.
In scope
- myshieldid.com and its US pages at myshieldid.com/us, the forwarding domains shieldid.ca and myshieldid.ca, and their subdomains, including the marketing site, the verification flow and the account portal
- The public ShieldID API
- Authentication, session handling and access control on any ShieldID-operated system
Out of scope
- Products and sites we don't operate, even if they use ShieldID (RentKey, Crown Ledger and Trust Ledger have their own security contacts)
- Third-party services we integrate with, unless the issue is in how we use them
How to report
Email us. Don't file a public issue or post first.
Send a report to [email protected] with as much detail as you can, and give us a reasonable window to respond before disclosing publicly.
Please include:
- The type of issue and the affected URL, endpoint or system
- Steps to reproduce, or a proof of concept
- What you were able to access or achieve, and how you confirmed it
- Any tools or scripts used, so we can reproduce your steps exactly
What we promise
An acknowledgement, a real look, and no legal trouble for good-faith research.
Acknowledgement
We aim to acknowledge a valid report within three business days of receiving it. That's a target we're stating publicly, not a measured average.
A genuine investigation
Every report is reviewed by someone who can act on it, not filtered by a form that goes nowhere.
No legal action for good-faith research
If you find and report a vulnerability in good faith, within this policy's scope, and without accessing, modifying or exfiltrating data beyond what's needed to demonstrate the issue, we will not pursue legal action against you for that research.
No bug bounty today
We don't currently run a paid bug-bounty program. We won't promise a reward we can't commit to, but we do promise to read and act on what you send us.
Out of scope
Please don't do any of the following as part of a report.
- Social engineering our staff, contractors or customers
- Physical attempts to access our offices or infrastructure
- Denial-of-service testing, or anything that degrades the service for real applicants
- Automated scanning at a volume that could affect other users, without asking us first
- Accessing, modifying or deleting another person's data beyond what's necessary to demonstrate an issue
- Spam, phishing or any attempt to test our staff's own judgement rather than the system
Safe harbour
Research done in good faith, inside this policy, is welcome.
We consider security research conducted in accordance with this policy to be authorized, and we won't initiate legal action for that research. This is general safe-harbour language, not a substitute for legal advice specific to your situation — if you're uncertain whether something is in scope, ask us before you test it.
Questions
Straight answers about reporting a vulnerability.
Ready to report?
Email [email protected] with what you found.
Include steps to reproduce and what you were able to access. We'll take it from there.