If you think that you have discovered a security vulnerability on SimpleBackups, we strongly recommend that you inform us as soon as possible. We will thoroughly examine all valid reports and make every effort to promptly resolve the issue. However, before submitting a report, please carefully review our responsible disclosure policy and reward guidelines, both of which are available on this page.

Responsible Disclosure Policy

If you adhere to the policies outlined below when reporting a security issue to SimpleBackups, we will refrain from pursuing legal action or involving law enforcement as a result of your report. Conduct outside the boundaries of this policy is not authorized, remains subject to our Terms and Conditions (§2.2, which prohibits attempting to gain unauthorized access to the Services or interfering with their security or integrity), and is governed by Belgian law with the courts of Brussels, Belgium having exclusive jurisdiction (§13.6). We kindly request that:

  1. You to make a sincere attempt to respect privacy and avoid causing disturbances for others. This includes, but is not limited to, refraining from unauthorized access to or destruction of data, as well as avoiding any interruptions or degradation of our services.
  2. You refrain from exploiting any security issues you may discover, even for the purpose of demonstrating additional risk. This includes attempting to compromise sensitive company data or probing for additional issues.
  3. You shall not knowingly breach any applicable laws or regulations, including those pertaining to the unauthorized access of data.
  4. For the context of this policy, you are expressly prohibited from accessing user or company data, encompassing personally identifiable information and any data associated with an identified or potentially identifiable individual.
  5. Before starting any active testing, send a heads-up to [email protected] with your intended scope and the account/email you'll be testing from. This lets us tell your testing traffic apart from an actual attack. Only target your own SimpleBackups account, never another customer's, and this applies doubly before running any automated scanner.

Bug Bounty Program Terms

SimpleBackups acknowledges and rewards security experts who assist in ensuring the safety of our users by reporting potential vulnerabilities within our system. The decision to grant monetary rewards for these reports rests solely with SimpleBackups, and is influenced by factors such as risk and potential impact. To be considered for a reward, you must fulfill the subsequent criteria:

  1. Comply with our Responsible Disclosure Policy (referenced above).
  2. Identify and report a security-related flaw, specifically a vulnerability within our services or infrastructure that poses a threat to security or privacy. It's imperative to note that the classification of an issue as a security risk is determined by SimpleBackups, and not all software bugs fall under this category.
  3. We are committed to assessing and acting upon all credible reports. However, due to the sheer number of reports we receive, our attention is directed towards those with higher associated risks. As such, there may be a delay before you receive our response.
  4. In cases where multiple reports address the same vulnerability, the reward will be allocated to the individual who reported it first. SimpleBackups has the authority to identify duplicate reports and may opt not to disclose information on subsequent reports. Each reward is issued to a single individual.
  5. We retain the discretion to publicly share any reports, along with any pertinent updates.
  6. Reports should be directed to the email address [email protected]. It's also essential to engage in any further communication requested by our team to provide additional details or updates.
  7. We will handle your report with strict confidentiality and will not share your personal details with third parties without your permission.