# Security Policy

## Reporting a Vulnerability


### The rules
- Please provide detailed reports with reproducible steps. 
- Submit one vulnerability per report, unless you need to chain vulnerabilities to provide impact.
- When testing has an overlap with systems or services not owned by you, the tester, make a good faith effort to avoid privacy violations, destruction of data, and interruption or degradation of that service. Only interact with accounts you own or with the explicit permission of the account holder.

### Disclosure Policy
Please do not discuss any vulnerabilities (even resolved ones) without express consent.

### Submit your report
When you've found a security issue that abides by the rules and scope of this project, please submit the report to us via heyyy@wpchill.com. In your mail, make sure to include:

- the impact of the issue;
- a detailed guide on how to reproduce the issue;

### After your submission
We will make a best effort to meet the following response targets for security reports:

- Time to first response (from report submit) - 5 business days
- Time to triage (from report submit) - 15 business days
