Legal & privacy.

How to report an issue

If you have discovered an issue or vulnerability that is in-scope (see below), please send an email to [email protected] with the following details:

• A summary of the vulnerability and potential impact
• Steps to reproduce the issue, including screenshots
• Details of your environment including OS, browser, and device details
• If possible, proof-of-concept code to exploit the vulnerability

Upon receiving your email, our team will conduct an investigation. We will update you on our progress and may request further details or retesting of the finding if needed.

All original reports will be considered, and bounties may be issued at our sole discretion.

In scope

• https://mosaic.so
• https://motion.so
• https://edit.mosaic.so
• https://api.mosaic.so
• Mosaic integrations and apps
• Vulnerabilities which apply to Mosaic's hosted platform and customers' projects. Do not attempt to reproduce or exploit these vulnerabilities on customer projects without express permission and communication from the customer and Mosaic teams.

Out-of-scope

• Automated scanning
• Social engineering, particularly involving Mosaic employees
• Missing or insufficient rate limiting
• Missing headers in responses, except in cases where material harm or exploitation is evident
• Security configuration observations without a demonstrated path to unauthorized access, data exposure, privilege escalation, or other material impact
• Brute force attacks
• DDOS attacks
• Clickjacking on pages with no sensitive actions
• Theoretical attacks without proof of exploitability
• Attacks requiring physical access to a victim's device
• Attacks requiring interception of a valid user's network traffic
• Denial of service attacks

We kindly ask you

• Test the vulnerability on your own account. If testing on another account, make sure to have requested explicit permission.
• Do not copy or destroy production data.
• Do not engage in activities that will cause downtime for our services.
• Avoid violations to our privacy policies, terms of service, and other data privacy regulations.
• Do not make the vulnerability public before reporting it to us via the procedures above, and giving us enough time to properly address the issue.

Report Format

• Reports must be made to [email protected]
• Reports must include a summary of the vulnerability and potential impact, including a calculated CVSS score and how you arrived at that score.
• Reports must demonstrate the actual security impact. For example, if a report claims data exfiltration, the proof of concept must show that protected data can be read without access to another user's credentials, tokens, device, or private account state.
• Reports must include steps to reproduce the issue, including screenshots. Video-only recordings are insufficient.
• Reports must include details of your environment including OS, browser, and device details.
• Reports must include proof-of-concept code or any payloads used to exploit the vulnerability.

Risk Assessment and Bounties

• Risk assessment and bounties will be determined on a case-by-case basis by our security team, leveraging the CVSS v3 and v4 scoring system with internal knowledge of our systems to accurately inform the assessment.
• Mosaic determines severity based on reproducible impact, affected data, required attacker prerequisites, and compensating controls. Researcher-provided severity labels, automated scanner output, or CVSS scores are helpful context, but they do not determine eligibility or payout.
• We may remediate or harden behavior reported to us without awarding a bounty if the report does not demonstrate material security impact.
• Mosaic may, at its sole discretion, provide a nominal appreciation payment for useful hardening reports that do not qualify for a bounty. Such payments are not severity determinations and do not create precedent for future reports.
• Previous bounty amounts, from Mosaic or other bug bounty programs, are not to be considered precedent when determining bounty amounts.
• Bounty amounts and payments, if any, are subject to change at our sole discretion, and will be communicated to you via email.
• Bounties will be paid in US dollars, via PayPal Goods & Services.
• Bounties will be paid out within 30 days of the vulnerability being retested and remediation confirmed.