Vulnerability disclosure program at Shapr3D

WINDOWS

Download for Windows

Requires Windows 10 2004 or later

iPadOS

Requires iPadOS 16 or later
preferably with Apple Pencil

macOS

Download for macOS

Requires macOS Ventura (13.0) or later

Installation guide

Report a Security Vulnerability

At Shapr3D our top priority is the safety, security and control of our customers' data. To excel at this, we welcome the vital role that security researchers play in keeping systems and data safe. To encourage the responsible reporting of potential security vulnerabilities, the security team at Shapr3D has committed to working with the community to verify, reproduce and respond to legitimate reports.
‍
If you believe you've identified a potential security vulnerability in any Shapr3D services, please report it to us right away. We will investigate all legitimate reports and do our best to quickly address the problems.
‍
Please do not disclose your findings until we have had the opportunity to review and address them with you. Shapr3D will consider the researcher's request to make a public disclosure but reserves the right to deny such disclosure requests. We appreciate your help in keeping Shapr3D secure for our community.

Responsible Disclosure Guidelines

To encourage responsible disclosure, we will not initiate any legal action against security researchers for assessing vulnerabilities as long as they adhere to this policy, including the following guidelines:

We have partnered with HackerOne for our vulnerability disclosure program. Notify us and provide all details of vulnerabilities you find using the HackerOne form below.

Provide all details including the Shapr3D account username, IP address and the date/timestamp of the vulnerability to support validation and reproduction of the issue.

You may only test against your own Shapr3D accounts. Do not interact with any account that you don’t own (such as by modifying or accessing data from the account).

Do not access or attempt to access data that does not belong to you.

Do not exploit a security issue you discover for any reason. (This includes demonstrating additional risk, such as attempted compromise of sensitive data or probing for additional issues.)

Do not perform actions that may negatively affect our services or its users, such as: executing or attempting to execute any “Denial of Service” attack, posting, transmitting, uploading, linking to, sending or storing any malicious software and/or file, testing third-party applications, websites or services that integrate with or link to our applications.

Do not conduct non-technical attacks such as social engineering, phishing or unauthorized access to infrastructure and our employees.

Do not test the physical security of our offices, employees, equipment, etc.

By reporting a security bug or vulnerability, you give us the right to use your report for any purpose.

Vulnerability disclosure program

Report a Security Vulnerability

Responsible Disclosure Guidelines

Public Acknowledgement Policy

Privacy

Policy Changes