Security

Reporting a vulnerability

Email security@hellohq.com. Please use this address rather than a public issue, so the details stay private while we work on a fix.

• Tell us what you found, the steps to reproduce it, and what an attacker could do with it.
• A proof of concept, screenshots, or the affected app version and account help, but are not required.

Good-faith research

We support security research done in good faith. To keep that support, we ask that you:

• Give us a reasonable chance to investigate and fix the issue before you disclose it publicly.
• Test only against your own account and data. Do not access, change, delete or copy anyone else’s.
• Avoid privacy violations, disruption to other users, and anything that degrades the service, such as denial-of-service testing.
• Do not use social engineering, phishing or physical attacks against our team or users.

What we commit to

• We will acknowledge your report within three business days, and keep you updated as we investigate and fix it.
• We will not pursue legal action against you for good-faith research that follows this policy.
• We will credit you for the finding once it is fixed, if you would like us to.
• We will tell you what we changed, so you can confirm the fix.

Scope

In scope are the HelloHQ apps, this website and our hosted services.

• Out of scope: issues that need a compromised device or your master password; configuration or best-practice suggestions with no demonstrated impact; and third-party services we rely on, which should be reported to the vendor.
• Your financial records are encrypted on your device before they leave it, so we may not be able to see or reproduce data we cannot decrypt. That is by design.

Contact

Report a vulnerability, or ask a question about this policy: security@hellohq.com.