At Macaw, we take the security of our systems very seriously. Despite our efforts to ensure the security of our systems, it is still possible that a vulnerability exists that we have not yet discovered.

If you’ve found a vulnerability in one of our systems, please let us know as soon as possible so we can take immediate action. We’d like to work with you to better protect our customers and our systems.

How you can help us.

• By emailingyour findings to cvd@macaw.one .
• By not exploiting the vulnerability you found. For example, by downloading, viewing, deleting, or modifying data.
• By not sharing the vulnerability you found with others until it has been resolved.
• By deleting all confidential data obtained through the vulnerability immediately after it has been resolved.
• Do not use physical security attacks, social engineering, Distributed Denial of Service, spam, or third-party applications.
• Provide sufficient information to reproduce the issue so that we can resolve it as quickly as possible. Usually, the IP address or URL of the affected system and a description of the vulnerability are sufficient, but more information may be required for more complex vulnerabilities.
  

Our Response

• Within one business day, you will receive an email confirming receipt of your report.
• We will respond to your report within five business days with our assessment of the report and an expected date for a resolution.
• If you have complied with the above conditions, we will not take any legal action against you in connection with the report.
• We will treat your report confidentially and will not share your personal information with third parties without your consent, unless it is necessary to comply with a legal obligation. Reporting under a pseudonym is, of course, possible.
• We will keep you informed of the progress made in addressing the vulnerability.
• In public communications regarding the reported vulnerability, we will, if you wish, credit you as the discoverer.
• As a token of our appreciation, every report of a vulnerability previously unknown to us will be rewarded with a Macaw hoodie!

We strive to resolve all issues as quickly as possible, and we would appreciate being involved in any publication regarding the vulnerability after it has been resolved.