Security
If you believe you have found a security vulnerability in spertsuite.com or in any SPERT® Suite app, please report it privately. Please don’t report it in a public issue, discussion or post.
How to report
Email security@spertsuite.com.
Or use GitHub’s private vulnerability reporting on the repository for the app concerned:
- spertsuite.com and the Connect AI server —
famousdavis/spert-landing - SPERT® Scheduler —
famousdavis/spert-scheduler - SPERT® Story Map —
famousdavis/spert-story-map - SPERT® Forecaster —
famousdavis/spert-forecaster - GanttApp™ —
famousdavis/GanttApp - SPERT® CFD —
famousdavis/spert-cfd - MyScrumBudget™ —
famousdavis/myscrumbudget-web - SPERT® AHP —
spert-suite/spert-ahp
What to include
- which site or app is affected, and the address of the page;
- what the problem is, and what someone could do with it;
- the steps to reproduce it, using your own account and your own data;
- how to reach you, and whether you would like to be credited.
Please don’t include anyone else’s personal data in a report.
What happens next
- We aim to acknowledge your report within 3 business days.
- We will keep you informed while we investigate and fix it, and credit you if you wish.
- When a fixed issue could have affected users’ data, we publish a short security advisory after the fix is deployed.
The SPERT® Suite does not run a paid bug bounty.
Scope
In scope: spertsuite.com, the SPERT® Suite apps at spertsuite.com addresses, and the SPERT® Suite’s own server code, including the Connect AI server.
Out of scope:
- the platforms the suite runs on, such as Google Cloud and Firebase, Vercel, Microsoft, GitHub and Resend (please report those to the provider);
- testing against other people’s accounts or data;
- denial-of-service, load or volume testing;
- social engineering and phishing.
Privacy
For privacy questions, or requests about your data, email privacy@spertsuite.com.
This information is also published in machine-readable form at /.well-known/security.txt (RFC 9116).