Docstation Vulnerability Disclosure

generated: '2026-08-10'
method: searched
source: https://docstation.co/legal/responsible-disclosure
published: true
policy_url: https://docstation.co/legal/responsible-disclosure
policy_title: Responsible Disclosure Policy
policy_version: '1.0'
policy_last_updated: '2024-12-26'
policy_effective: '2024-12-26'
security_txt: false
security_txt_note: >-
  No /.well-known/security.txt is served. https://docstation.co/.well-known/security.txt
  returned 404 on 2026-08-10; the policy is published as a legal page instead.
contact:
  email: security@docstation.co
  pgp: >-
    "If you choose to email us, encrypting your email is not required. Should you
    deem it necessary, you can find our encrypted contact details on Keybase (for
    PGP or Keybase itself)."
  form: null
bug_bounty:
  offered: true
  platform: self-managed
  reward_type: cash and prizes
  amounts_published: false
  quote: >-
    "DocStation awards security researchers cash and prizes for reporting
    vulnerabilities. Please email security@docstation.co to report an issue."
scope:
  in_scope:
  - app.docstation.co
  out_of_scope:
  - Any service not listed under In-Scope Services
  - DOS attacks
  - Brute force attacks
  - Physical vulnerabilities
  - Social engineering (phishing, email auth/SPF/DKIM, hyperlink injection in emails)
  - CSRF on anonymous forms (sign up, login, contact, Intercom)
  - Self-XSS and issues exploitable only through self-XSS
  - Clickjacking and issues only exploitable through clickjacking
  - Functional, UI and UX bugs and spelling mistakes
  - Descriptive error messages (stack traces, application or server errors)
  - HTTP 404 codes/pages or other HTTP error code pages
  - Banner disclosure on common/public services
  - Disclosure of known public files or directories (e.g. robots.txt)
  - Browser autocomplete / save password permission
  - User enumeration on login
  - Absence of rate limits
rules:
- NEVER attempt to gain access to another user's account or data
- NEVER attempt to degrade the services
- NEVER impact other users with your testing
- Test only on in-scope domains
- Do not use fuzzers, scanners, or other automated tools to find vulnerabilities
safe_harbor: false
safe_harbor_note: >-
  The policy contains no explicit legal safe-harbor clause. It commits to
  collaboration — "we will work with you to make sure we understand the scope and
  cause of the issue" — but names no response SLA and grants no authorization
  language.
response_sla: null
notes: >-
  A real, dated, versioned responsible-disclosure policy with a named security
  contact and a cash bounty. The gap is discoverability: it is not linked from a
  /.well-known/security.txt, so an automated scanner or agent will not find it.
x-evidence:
- url: https://docstation.co/legal/responsible-disclosure
  http_status: 200
  fetched: '2026-08-10'
- url: https://docstation.co/.well-known/security.txt
  http_status: 404
  fetched: '2026-08-10'