At Podia, the security of our users and their customers is highly important to us. As such, we welcome the responsible disclosure of security vulnerabilities by researchers and members of our community.
Please note that at this time, we do not have a bug bounty program in place. As such, we are unable to provide monetary compensation for the disclosure of security vulnerabilities.
How to report an issue
If you have discovered an issue that is within in scope, and particularly part of our focus areas, send an email to [email protected] with the following details:
A summary of the issue and potential impact
A breakdown of the steps to replicate the issue
Details of the environment you are using
If available, any proof-of-concept code to exploit the vulnerability
Upon receiving your email, our team will start investigating the issue.
We will keep you updated on the progress and may reach back for further details if needed.
In-scope vulnerabilities
The following vulnerabilities are in-scope:
Authentication bypass and privilege escalation
Exposure of personally identifiable information (PII)
Exposure or exploitation of payment-related API credentials
Exposure of integration credentials
Access to data belonging to another user
SQL injection and remote command execution
Within the following systems:
Podia app (app.podia.com)
User sites (*.podia.com)
Podia's Zapier integration
Out-of-scope
The following areas are out-of-scope for security testing and reporting. As such, we may ignore or dismiss out-of-scope reports
Our marketing site at www.podia.com
Any form of:
Automated scanning
Social engineering, in particular of Podia employees or creators
Denial of Service attacks
Attacks requiring physical access to the victim's computer
Theoretical attacks without proof of exploitability
Man-in-the-middle attacks
Clickjacking on pages with no sensitive actions
Users exploiting a bug to sabotage their own account, storefront, or customers
Bugs that allow an attacker to bypass account limits
Missing best practices in CSP, DNS records, or cookies that do not result in an in-scope vulnerability.
You should…
only test for vulnerabilities on your own account
make a good faith effort to avoid privacy violations, copying or destruction of data, and interruption or degradation of our service
not attempt to expand or elevate access to other servers
not attempt to exploit our infrastructure provider, partners, or any third-party services we are integrated with
not make the vulnerability public before reporting it to us, and you should give us adequate time to address the issue
not attempt to extort payment in exchange for disclosing vulnerabilities, or to exploit vulnerabilities for personal gain.
Please note that any attempt to do so will be considered unethical, and potentially illegal behavior, and will be handled accordingly.