Vulnerability Disclosure Policy

01Scope

This policy covers:

• jobskru.com and its pages (including /th)
• The JobsKru API the website uses
• cdn.jobskru.com (our public file storage)

Services run by other companies that we use, such as Cloudflare, Supabase and Stripe, are not covered. Please report issues in those directly to the company concerned.

02Testing guidelines

When you research a vulnerability, please:

• Use only accounts you created yourself, or accounts whose owner has given you explicit permission.
• Access only as much data as you need to show the problem. If you come across personal data of other people, such as CVs, applications, contact details or documents, stop, do not keep or share it, and tell us in your report.
• Avoid harming the service or its users: don’t change or delete data that isn’t yours, and don’t degrade the website for others.
• Do not post fake jobs or send messages or applications to real schools or educators while testing.
• Give us a reasonable time to fix the issue before you tell anyone else about it (see Disclosure below).

03Not allowed

• Denial-of-service attacks, load testing, or anything else that degrades the service
• Spam, or automated scanning that sends large amounts of traffic
• Social engineering or phishing of JobsKru staff, schools or educators
• Physical attacks on offices, people or equipment
• Attacks on the systems of our providers (Cloudflare, Supabase, Stripe and others)
• Keeping, changing, sharing or publishing other people’s data

04Usually not accepted

The following are usually not treated as vulnerabilities unless you can show a real security impact:

• Reports from automated scanners with no proof that the issue can be exploited
• Missing security headers or cookie flags that have no exploitable impact
• Clickjacking on pages with no sensitive actions
• Cross-site request forgery (CSRF) on sign-out or other actions with no impact
• Rate-limit issues with no meaningful impact
• Software version disclosure, or verbose error messages that reveal no sensitive data
• Issues that only affect outdated or unsupported browsers
• Email setup (SPF, DKIM, DMARC) findings with no demonstrated spoofing

05How to report

Email security@jobskru.com, in English or Thai. Please include:

• What the vulnerability is and where it is (the URL or API endpoint)
• Step-by-step instructions to reproduce it, with any proof-of-concept code, screenshots or video
• The impact: what an attacker could do with it
• The accounts you used for testing
• How you would like to be credited, if at all

Please keep the details private between you and us until the issue is fixed.

06What you can expect from us

• We will acknowledge your report within 5 business days.
• We will assess it and tell you whether we accept it, and how serious we think it is, within 10 business days.
• We aim to fix critical issues within 7 days and others as soon as we reasonably can, and we will keep you updated.
• We will tell you when the issue is fixed.
• With your permission, we will credit you by name once the fix is live.

07Disclosure

Please do not tell others about the vulnerability until we have fixed it, or until 90 days after your report, whichever comes first. If we need longer, we will explain why and agree a date with you. We are happy to coordinate a joint publication.

08Safe harbour

If you research and report in good faith and follow this policy, we will consider your research authorised. We will not take legal action against you for it, and we will not ask the authorities to do so. If someone else brings legal action over research that followed this policy, we will make it known that your actions were authorised.

This applies only to JobsKru’s own systems. We cannot authorise testing of other companies’ systems. If you are unsure whether something is allowed, ask us first.

09Rewards

JobsKru does not currently run a paid bug bounty programme. We are grateful for every valid report and are happy to credit you publicly.

10Changes to this policy

We may update this policy from time to time. The current version is always on this page, with the date it last changed.

11Contact

Reports and questions about this policy: security@jobskru.com.