Responsible Disclosure

Last updated: June 8th, 2021

1. Policy

At 7shifts we believe in leveraging the skills of security researchers around the globe to identify weaknesses in our technology. If you believe you’ve found a security issue in our services, we encourage you to notify us.

We administer bounties through a private HackerOne program.

2. Program Rules

Please provide detailed reports with reproducible steps. If the report is not detailed enough to reproduce the issue, the issue will not be eligible for a reward.
Submit one vulnerability per-report, unless you need to chain vulnerabilities to provide impact.
When duplicates occur, we only award the first report that was received (provided that it can be fully reproduced).
Multiple vulnerabilities caused by one underlying issue will be awarded one bounty.
Social engineering (e.g. phishing, vishing, smishing) is prohibited.
Make a good faith effort to avoid privacy violations, destruction of data, and interruption or degradation of our service. Only interact with accounts you own or with the explicit permission of the account holder.

3. Disclosure Policy

Let us know as soon as possible upon discovery of a potential security issue, and we'll make every effort to quickly resolve the issue.
Provide us at least 60 days time to the issue before any disclosure to the public or a third-party. Notify us of your intended disclosure date.
Make a good faith effort to avoid privacy violations, destruction of data, and interruption or degradation of our service. Only interact with accounts you own or with explicit permission of the account holder.
Try not to create multiple accounts, unless absolutely necessary and limit up to two accounts total if multiple accounts are needed. For additional accounts, please contact us for permission first.

4. Scope

Domains
1. app.7shifts.com
2. api.7shifts.com (app.7shifts.com/api)
3. files.7shifts.com
4. gql.7shifts.com

5. Out of Scope & Exclusions

The following items are out-of-scope and are not covered under our bounty program:

All other domains and subdomains not listed in scope above
XSS & CSRF on any domain other than app.7shifts.com
Denial of Service (DDoS)
DMARC / SPF Records on 7shifts.com
Social engineering (e.g. phishing, vishing, smishing) is prohibited.

6. Safe Harbor

Any activities conducted in a manner consistent with this policy will be considered authorized conduct and we will not initiate legal action against you. If legal action is initiated by a third party against you in connection with activities conducted under this policy, we will take steps to make it known that your actions were conducted in compliance with this policy.

Thank you for helping keep 7shifts and our users safe!

7. Reporting

Please email security@7shifts.com with your findings. You’ll receive an automated response from HackerOne with instructions to complete your findings report, which 7shifts can then act upon.

Scheduling

Time Clocking

Tip Management

Payroll

Team Engagement

Task Management

Team Communication

Manager Log Book

Labor Compliance

Document Storage

Bakeries

Bars & Breweries

Cafes & Coffee Shops

Catering

Juice Bars

Pizzerias

Pubs

Full Service

Quick Service

Templates

Food Runner

Restaurant Data

Case Studies

Podcast

Blog

Support

Academy

What Restaurant Employees Want

How Vitality Bowls saved thousands in just 8 weeks

Tip outs and tip pools, explained