Reporting a security issue
Families keep their trees, photos, documents and DNA in Ancestral Nest. If you find a way to reach what you should not, please tell us first, so we can fix it before anyone else finds it.
How to report
Write to [email protected] with “Security” in the subject. English or Russian is fine. Please include:
- what you found, and where: the address, and the request if there is one;
- the steps to reproduce it, from a fresh account if you can;
- what an attacker could do with it.
Please do not put the details in a public place, such as an issue tracker or social media, until we have fixed it.
What you can expect from us
- We will reply within three working days to say we have your report.
- We will tell you whether we can reproduce it, and keep you up to date until it is fixed.
- We aim to fix serious issues within 30 days, and will agree a date with you before anything is published.
- If you wish, we will thank you by name on this page once it is fixed. We do not pay rewards for now.
What is in scope
- ancestralnest.com, these pages;
- app.ancestralnest.com, the archive itself and its API;
- demo.ancestralnest.com, the read-only example families.
What we most want to hear about: reaching another family's archive, a member doing more than their role allows, taking over an account, and files or text that make the server do something it should not.
Not in scope: denial of service and load testing; phishing, spam or social engineering of members or of us; physical access; services we use but do not run, such as Cloudflare or email providers; and reports from automated scanners without a demonstrated problem, such as a missing header that changes nothing.
Rules for testing
- Test only with your own accounts and archives, or on the demo. The demo is the place to try things without an invitation.
- Do not read, change, copy or keep anyone else's data. If you come across another family's data, stop, do not keep it, and tell us.
- Do not do anything that degrades the service for others, and stop if you notice that you are.
- Give us a reasonable time to fix an issue before you disclose it.
If you follow these rules and act in good faith, we will not take legal action against you for your research, and we will treat it as authorised.