Reporting a vulnerability
If you believe you've found a security vulnerability in Autoview, we want to hear from you. Please report it privately rather than opening a public issue or posting about it before we've had a chance to respond.
Email security@autoview.com with a description of the issue, the steps to reproduce it, and its potential impact. We'll acknowledge your report and follow up as we investigate.
Our full policy is also published machine-readable at /.well-known/security.txt, per RFC 9116.
Safe harbor
We consider security research conducted under this policy to be authorized. We will not pursue legal action against, or refer to law enforcement, anyone who makes a good-faith effort to comply with it. This includes avoiding privacy violations, service disruption, and destruction of data, and reporting findings to us before disclosing them to anyone else.
In scope
- autoview.com, this website and the account application (including MCP tokens under
/account/tokens/) - api.autoview.com, the API used by the browser extension and account application
- The Autoview browser extension for Chrome
- Our webhook/IPN receivers, e.g.
/ipn/pwp/and/ipn/klaviyo/
Out of scope
These hosts and services are either redirect-only entry points into the same worker above, or third-party services we don't operate. Please report issues with them directly to their own owner, not to us.
- use.autoview.com, help.autoview.com, articles.autoview.com: legacy domains that only 301-redirect into autoview.com; there is nothing served here beyond the redirect itself
- status.autoview.com: our status page, hosted by our uptime-monitoring vendor
- pay.with.pink: our payment processor. It shares a developer with Autoview but is a separate service operated independently; please report issues with it to its own operator, not to us
- Klaviyo, Twilio, Mailgun, Partnero, Calendly, and Cloudflare: third-party vendors we use; please report issues with their platforms directly to them
- Denial-of-service, spam, or social-engineering reports against any Autoview staff or user
Hall of fame
We're grateful to the researchers who've reported issues responsibly. See our hallway.txt for the list.