Listed and ranked
Marsell markets and sells for businesses. It holds their data, their connected accounts and their approval over everything it posts, sends and spends. If you find a way around any of that, we want to hear about it.
Reporting a vulnerability
Email [email protected]. Please don't report a security problem in public, for example in a GitHub issue, pull request or discussion.
Include what you can of:
- what the problem is, and what someone could do with it;
- the steps to reproduce it: the URLs, endpoints or requests involved, and the account or setup you used;
- a proof of concept (screenshots, a short video, a script);
- how you would like to be credited, if at all.
If you can't share something safely by email, say so in a first message and we will agree on another way.
What happens next
- We acknowledge your report within 3 business days.
- We tell you what we found, and whether we accept the report, within 10 business days.
- We aim to fix critical issues within 30 days and the rest within 90 days, and we keep you posted until the fix ships.
- With your permission, we thank you by name when the fix is announced. We don't run a paid bug bounty yet.
We ask you to keep the details private until a fix is live, or for 90 days from your report, whichever comes first. If we need longer, we will tell you why and agree on a date with you.
Scope
In scope:
- getmarsell.com: the website, the workspace (
/app) and the API behind it (/api). - Hosted sites on
*.marsell.siteand on getmarsell.com's/_sites/paths: the hosting itself, not the content our customers publish there. - Marsell's code, as it runs in production. Marsell is a hosted service that is deployed continuously, so only the live service and its latest code are supported; there are no older versions to patch.
We especially care about:
- one business, or anyone else, reaching another business's data, files, films or connected accounts;
- getting Marsell to post, send, publish or spend without the owner's approval, including by planting instructions in a website, comment, email or file that Marsell reads (prompt injection);
- account takeover, or bypassing sign-in or the invite list;
- leaking tokens for accounts customers connect (Google, YouTube, social platforms, email);
- making the servers fetch private or internal addresses (SSRF) through the site crawler, image downloads or imports;
- script injection that crosses from a hosted site into getmarsell.com;
- tampering with plans, token balances or billing.
Out of scope:
- vulnerabilities in the services we use (our hosting, sign-in, payment, AI and media providers); please report those to the provider. A way to misuse our integration with them is in scope;
- denial of service, load testing, and spam;
- social engineering, phishing, and physical attacks against people or offices;
- scanner output, missing headers or best practices without a demonstrated impact;
- self-XSS, clickjacking on pages with no sensitive action, and logout or login CSRF;
- content that customers publish on their hosted sites; report abuse to [email protected] as well, and we will route it;
- keys, passwords and tokens in tests and fixtures, which are fake on purpose. A report about a leaked secret needs to show a real, working credential. Don't use it beyond confirming that it works.
Testing rules
- Test only against accounts you created. Never access, change or delete another person's data; if you reach any by accident, stop, don't keep a copy, and tell us.
- Don't degrade the service for others: no denial-of-service tests, and keep automated requests to a gentle rate.
- Don't let Marsell post, send or spend anything real on a third party's behalf while you test.
- Give us reasonable time to fix a problem before you disclose it.
Safe harbor
If you make a good-faith effort to follow this policy, we consider your research authorized. We won't take legal action against you or ask anyone else to, and if someone else does over research that followed this policy, we will make it known that you acted with our permission. If you're unsure whether something is allowed, ask us first at [email protected].