Security: report a vulnerability

If you have found a security flaw in Codeqlick, thank you for telling us. We review every report and always answer.

How to report it

Email hello@codeqlick.com with "Security" in the subject. Include:

• What you found and where (the exact address).
• The steps to reproduce it, and screenshots or a proof of concept if you have them.
• What someone exploiting it could do.
• How you'd like to be credited, if you'd like to be.

In scope

• codeqlick.com and api.codeqlick.com.
• Every app on a codeqlick.com subdomain (videochat, meetings, citas, swipe, cloud…).
• The client websites we publish.

Out of scope

• Denial of service, or tests that overload the server.
• Spam, social engineering or tricking the team or users.
• Physical access to devices or offices.
• Automated scanner output without proof the flaw can be exploited.
• Missing best practices with no real risk (for example, a header that changes nothing).

Good-faith rules

• Don't access, change or delete other people's data beyond the minimum needed to show the flaw.
• If you see personal data, stop, don't keep it, and tell us.
• Don't disclose it publicly until we have fixed it.

If you follow these rules, we won't take legal action against you for your research.

What we do

• We answer within 5 working days.
• We tell you what we will do and let you know when it's fixed.
• If you want, we thank you by name on this page.

This contact is also published at /.well-known/security.txt.