Vulnerability Disclosure Program

If you find a security problem in something Expedition Labs runs or publishes, we want to hear about it. We will work with you to understand it and fix it, and we will not take legal action against research done in good faith under this program.

Please report privately. Do not open a public issue.

• For Meeting Mouse, use GitHub's private vulnerability reporting on the masaok/meetingmouse repository: open its Security tab and choose Report a vulnerability.
• Or write to support@meetingmouse.net for Meeting Mouse, and to hello@expeditionlabs.co for this website.

Include the address or component affected, the steps to reproduce it, and what an attacker would gain. A working example helps us confirm it quickly.

• An acknowledgement within 7 days.
• A fix, or a reasoned decision, as soon as one exists. We tell you which.
• Credit for the finding when the fix is published, if you want it.

We do not run a bug bounty and do not pay for reports.

• This website, expeditionlabs.co.
• The hosted Meeting Mouse app at app.meetingmouse.net and its website at www.meetingmouse.net.
• The open-source Meeting Mouse code: verification of Slack request signatures, who may act on a poll, anything that exposes credentials or another workspace's data, and injection through poll titles or Slack payload fields.

• The Slack platform itself. Report those problems to Slack.
• Problems in our hosting or database providers. Report those to the provider.
• A self-hosted copy of Meeting Mouse that someone else configured.
• Findings that need a bot token or database credential that is already compromised.
• Denial of service by volume, social engineering, and physical attacks.

• Test only against a Slack workspace you control.
• Stop when you have shown the problem exists. Do not read, change or delete data that is not yours.
• Do not degrade the service for others.
• Give us a reasonable time to fix the problem before you describe it publicly.

When this program changes, this page is updated and given a new effective date.

Questions about this page go to hello@expeditionlabs.co. Requests about data held by Meeting Mouse go to support@meetingmouse.net.