Reporting a security problem

• examkind.com and its subdomains
• ExamKind accounts and the sign-in and sign-up pages
• Our public tools, data downloads and website widgets

Services run by other companies, such as our hosting provider or Google and Apple sign-in, are not covered. Please report problems with them to the company concerned. If you're not sure whether something is in scope, ask us first.

• Don't access, download, change or delete information that isn't yours. If you come across personal information, stop, don't keep a copy, and tell us what you saw.
• Never try to see or contact children, or access a child's information.
• Don't run denial-of-service attacks, or tests that slow ExamKind down for other people. Keep automated scanning gentle.
• Don't use social engineering, such as phishing our staff or pretending to be someone else.
• Don't try to get into our offices, data centres or devices.
• Don't send spam through our forms or post test content in our community where other people can see it.
• Don't use what you find for anything except reporting it to us.

Email security@examkind.com with:

• what the problem is and which page or address it affects;
• the steps to reproduce it, with screenshots or a short video if that helps;
• what someone could do with it, as far as you know;
• how you would like to be credited, if at all.

Please write in English. Don't include anyone else's personal information in your report.

• Acknowledge your report within 3 working days.
• Check it, decide how serious it is and tell you what we found.
• Keep you updated until it is fixed, and tell you when it is.
• Thank you publicly once it is fixed, if you would like us to.

Please give us reasonable time to fix a problem before you share any details publicly, and agree the timing with us. We don't offer payment for reports at the moment.

If you act in good faith and follow this policy, we will treat your research as authorised, we will not take legal action against you, and we will not report you to the police for it. If someone else takes action against you for research that followed this policy, we will make it clear that it was authorised.

This promise does not cover anything that breaks the rules above, such as accessing other people's information, or anything we can't authorise, such as testing another company's services.

We review this policy at least once a year and whenever our services change.