Vulnerability disclosure

We take the security of Browse and its users seriously. If you believe you've found a vulnerability, please tell us so we can fix it.

How to report

Email security@dart.art with:

• what you found and where (app version, or the affected web address);
• steps to reproduce it, with a proof of concept if you have one;
• the impact you think it has; and
• how we can reach you, and whether you'd like to be credited.

Please don't share details publicly until we've had a reasonable chance to fix the issue.

Scope

In scope

• The Browse app for Android Automotive OS (package art.dart.browse).
• This website, browse.dart.art.

Out of scope

• Vulnerabilities in Mozilla's Gecko engine itself. Report those to Mozilla, and tell us too if Browse is affected.
• Vulnerabilities in your vehicle's own systems. Report those to the vehicle maker.
• Third-party websites you visit in Browse.
• Denial-of-service attacks, spam, social engineering and physical attacks.
• Reports from automated scanners without a demonstrated impact.

Testing rules

• Test only on vehicles and accounts you own or are explicitly authorized to use.
• Never test while driving or on public roads. Use a parked vehicle or an emulator.
• Don't access, change or delete other people's data. If you encounter it, stop and tell us.
• Don't degrade our services or other users' experience, and avoid high-volume automated testing of this website.
• Give us reasonable time to fix the issue before any disclosure.

Our commitment

If you follow this policy in good faith, we'll consider your research authorized, we won't pursue or support legal action against you for it, and we'll work with you to understand and fix the issue. We'll acknowledge your report, keep you updated as we investigate, and credit you when the fix ships if you'd like.

Our security.txt file lists the same contact in machine-readable form.