-
Notifications
You must be signed in to change notification settings - Fork 22
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
- Loading branch information
Showing
20 changed files
with
159 additions
and
28 deletions.
There are no files selected for viewing
Binary file modified
BIN
-2.78 KB
(94%)
src/assets/screenshots/developer/crowdin_apps_app_permissions.png
Loading
Sorry, something went wrong. Reload?
Sorry, we cannot display this file.
Sorry, this file is invalid so it cannot be displayed.
Binary file modified
BIN
-7.42 KB
(83%)
src/assets/screenshots/developer/crowdin_apps_app_permissions_e.png
Loading
Sorry, something went wrong. Reload?
Sorry, we cannot display this file.
Sorry, this file is invalid so it cannot be displayed.
Binary file modified
BIN
+11.5 KB
(110%)
src/assets/screenshots/developer/crowdin_apps_store_install.png
Loading
Sorry, something went wrong. Reload?
Sorry, we cannot display this file.
Sorry, this file is invalid so it cannot be displayed.
Binary file modified
BIN
+2.57 KB
(100%)
src/assets/screenshots/developer/crowdin_apps_store_install_e.png
Loading
Sorry, something went wrong. Reload?
Sorry, we cannot display this file.
Sorry, this file is invalid so it cannot be displayed.
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
|
@@ -9,9 +9,11 @@ import { Aside } from '@astrojs/starlight/components'; | |
|
||
The individuals and teams listed below were the first to inform us about vulnerabilities that could impact Crowdin or anyone using Crowdin. | ||
|
||
Each of them have helped us make Crowdin safer. | ||
Each of them has helped us make Crowdin safer. | ||
|
||
--- | ||
<Aside type="tip" title="Join our bug bounty program on HackerOne"> | ||
Crowdin is transitioning to managing its bug bounty program through HackerOne. The program is currently private. To request an invitation, contact [[email protected]](mailto:[email protected]) and include your HackerOne handle. | ||
</Aside> | ||
|
||
<div class="grid grid-cols-1 sm:grid-cols-3 gap-4"> | ||
<div> | ||
|
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
|
@@ -5,23 +5,33 @@ slug: vulnerability-policy | |
template: splash | ||
--- | ||
|
||
Privately share details of the suspected vulnerability with Crowdin by sending an email to [[email protected]](https://crowdin.com/contacts). Provide full details of the suspected vulnerability, so the Crowdin security team may validate and reproduce the issue. | ||
import { Aside, LinkButton } from '@astrojs/starlight/components'; | ||
|
||
Privately share details of the suspected vulnerability with Crowdin by sending an email to [[email protected]](mailto:[email protected]). Provide full details of the suspected vulnerability, so the Crowdin security team may validate and reproduce the issue. | ||
|
||
<Aside type="tip" title="Join our bug bounty program on HackerOne"> | ||
Crowdin is transitioning to managing its bug bounty program through HackerOne. The program is currently private. To request an invitation, contact [[email protected]](mailto:[email protected]) and include your HackerOne handle. | ||
</Aside> | ||
|
||
## Hall of Fame | ||
|
||
On behalf of our thousands of users, we thank the named researchers for helping make Crowdin safer. [View hall of fame](/hall-of-fame/). | ||
On behalf of our thousands of users, we thank the named researchers for helping make Crowdin safer. | ||
|
||
<LinkButton href="/hall-of-fame/"> | ||
View hall of fame | ||
</LinkButton> | ||
|
||
## What are We Looking for {#looking_for} | ||
|
||
When submitting an issue, please provide a technical description that allows us to assess exploitability and impact of the issue. | ||
|
||
- Provide steps to reproduce the issue, including any URLs or code involved. | ||
- If you are reporting a cross-site scripting (XSS), your exploit should at least pop up an alert in the browser. | ||
- If you are reporting a cross-site scripting (XSS), your exploit should at least pop up an alert in the browser. | ||
It is much better if the XSS exploit shows user's authentication cookie. | ||
- For a cross-site request forgery (CSRF), use a proper CSRF case when a third party causes the logged in victim to perform an action. | ||
- For a SQL injection, we want to see the exploit extracting database data, not just producing an error message. | ||
- HTTP request / response captures or simply packet captures are also very useful to us. | ||
- Please refrain from sending us links to non-Crowdin web sites, or issues in PDF / DOC / EXE files. | ||
- Please refrain from sending us links to non-Crowdin web sites, or issues in PDF / DOC / EXE files. | ||
Image files are OK. Make sure the bug is exploitable by someone other than the user (e.g., "self-XSS"). | ||
|
||
## What We are Not Looking for | ||
|
@@ -74,22 +84,22 @@ We ask that you do not share or publicize an unresolved vulnerability with/to th | |
|
||
Please note that by submitting us a vulnerability report, you grant us a perpetual, worldwide, royalty-free, irrevocable and non-exclusive license and right, to use, modify, and incorporate your submission or any parts thereof into our products, services, or test systems without any further obligations or notices to you. | ||
|
||
We would be thankful for any further relevant technical information that you may have, especially if reproduction is tricky. If we cannot reproduce it, we cannot reward you. | ||
We would be thankful for any further relevant technical information that you may have, especially if reproduction is tricky. If we cannot reproduce it, we cannot reward you. | ||
However, there is no need to describe the security impact of your finding - we understand security risks and we can figure that out. We only need technical details. | ||
|
||
## Rewards | ||
|
||
We maintain flexibility with our reward system; rewards are based on severity, impact, and report quality. | ||
We maintain flexibility with our reward system; rewards are based on severity, impact, and report quality. | ||
For example, we can provide you with a coupon to get Crowdin Swag. Depending on what you discover, you may go onto the Crowdin [Hall of Fame](/hall-of-fame/). | ||
If you would rather stay behind an alias (handle) or anonymous, we will of course respect that. | ||
|
||
We do have specific things we are (and are not) looking for - so check [What are we looking for](#looking_for). | ||
|
||
If you report several issues that are duplicates in different parts of the service (e.g., the same code running on different nodes or platforms), or part of a larger issue, these may be combined into one and only one reward may be possible. | ||
|
||
If someone else has already reported the finding earlier, we will let you know after the issue has been fixed. If several researchers report the same issue, we only reward the sender of the first report that provides us with enough technical details to reproduce the finding. | ||
If someone else has already reported the finding earlier, we will let you know after the issue has been fixed. If several researchers report the same issue, we only reward the sender of the first report that provides us with enough technical details to reproduce the finding. | ||
We know that this would give us a loophole to claim that everything's been already previously found, but trust us, we want to be fair. | ||
|
||
A reward will not be provided if the finding becomes known by anyone else than you or us, in any way, before it is fixed. | ||
|
||
You can always keep tracking of how your issue is progressing. Contact Crowdin Security team for this: [[email protected]](https://crowdin.com/contacts) | ||
You can always keep tracking of how your issue is progressing. [Contact Crowdin Security](https://crowdin.com/contacts) team for this. |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Oops, something went wrong.