FlashTower welcomes reports from security researchers and will work with you to understand and fix valid issues. This policy describes what you may test, how to report, what to expect from us, and the legal safe harbor we provide for good-faith research. It covers FlashTower's own systems only.
1. Scope
In scope
- flashtower.com and its subdomains operated by FlashTower.
- The FlashTower web application and its APIs, including FlashTower Monitor and FlashTower Guard (for example, bypassing approval, role, tenant-isolation, or multi-factor authentication requirements).
Out of scope
- Denial-of-service, load, or volumetric testing.
- Social engineering, phishing, or physical attacks against FlashTower personnel, offices, or vendors.
- Spam, or sending unsolicited messages through any FlashTower form or feature.
- Third-party services FlashTower uses (such as our hosting, email, payment, or analytics providers) — report issues to those vendors directly, unless the issue is in FlashTower's configuration of them.
- Systems of FlashTower customers, and any system connected to FlashTower that you do not own. This policy does not authorize testing them.
- Automated scanner output without a demonstrated security impact.
- Missing best-practice headers or configurations without a demonstrated security impact.
- Self-XSS, clickjacking on pages without sensitive actions, and issues that require a compromised device or browser.
2. How to report
Email security@flashtower.com. Please include:
- a description of the vulnerability and its potential impact;
- the affected URL, endpoint, or component;
- step-by-step instructions to reproduce, including any proof-of-concept;
- the account or organization identifiers you used for testing; and
- how you would like to be credited, if at all.
Do not include other people's personal data in your report. Our machine-readable contact details are published at /.well-known/security.txt.
3. Rules of engagement
- Test only against accounts and organizations you create. Never access, modify, or delete data belonging to others; if you encounter it, stop, do not retain it, and report immediately.
- Do not connect integrations to systems you do not own, and do not attempt to trigger response actions against third-party systems.
- Do not degrade the Service for other users; no denial-of-service, spam, or brute-force testing.
- Use the minimum access necessary to demonstrate an issue, and do not pivot to other systems.
- Keep the details confidential until we have resolved the issue, and coordinate disclosure timing with us (we suggest 90 days from your report).
- Comply with applicable law.
4. Our response targets
- Acknowledge your report within 3 business days.
- Complete triage and share our initial severity assessment within 10 business days.
- Keep you informed of progress and notify you when the issue is fixed.
5. Severity guidance
We assess severity using the Common Vulnerability Scoring System (CVSS) v3.1 or later, adjusted for the actual impact on FlashTower and its customers.
| Severity | CVSS | Examples |
|---|---|---|
| Critical | 9.0–10.0 | Cross-tenant access to another organization's data; authentication bypass; remote code execution; approving a Guard action without authorization |
| High | 7.0–8.9 | Privilege escalation within an organization; bypass of multi-factor authentication on approvals; stored XSS in an authenticated area |
| Medium | 4.0–6.9 | CSRF on a state-changing action; disclosure of limited non-public information; rate-limit bypass with security impact |
| Low | 0.1–3.9 | Information disclosure with minimal impact; issues requiring unlikely user interaction |
6. Safe harbor
If you make a good-faith effort to comply with this policy while researching FlashTower's own systems, we consider your research authorized under the Computer Fraud and Abuse Act and similar laws, and we will not pursue or support legal action against you for it. We waive any claim under the Digital Millennium Copyright Act's anti-circumvention provisions and similar laws, and any claim for breach of our Terms of Service or Acceptable Use Policy, to the extent your research was conducted in accordance with this policy. If a third party brings legal action related to your compliant research, we will make known that your actions were conducted under this policy.
This safe harbor applies only to FlashTower's own systems. We cannot authorize testing of systems we do not own, including our customers' and vendors' systems. If you are unsure whether an activity is consistent with this policy, ask security@flashtower.com before proceeding.
7. Recognition and bug bounty
We do not currently operate a paid bug bounty program, and submitting a report does not create an entitlement to payment. With your permission, we are happy to acknowledge your contribution publicly once the issue is resolved; public acknowledgement is optional and at your choice.
Contact
FlashTower is operated by Boostlete LLC, 1620 N Carpenter Rd, Suite D46, Modesto, CA 95351. Privacy and legal notices: privacy@flashtower.com. Security: security@flashtower.com. Support: support@flashtower.com. Billing: billing@flashtower.com. General inquiries: hello@flashtower.com.