Report Security Vulnerability

Flare is committed to resolving any issues that may compromise the security of our products and services as quickly as possible. We take security vulnerabilities very seriously and protecting customer data is one of our top priorities.

How to report a vulnerability

If you think you’ve found a security vulnerability in Flare products, services or online platforms, please contact us immediately via email. Keep your findings confidential and disclose the relevant information to us in a responsible manner by encrypting your report with our PGP key.

Please also advise if you have communicated the vulnerability to CERT or other parties and provide us with any reference numbers.

What to include in your report

An explanation of the security vulnerability
A list of the products and services that may be affected (versions where applicable)
Steps to reproduce the vulnerability
Proof-of-Concept code or software
Test accounts you have created
URLs, IP addresses or infrastructure associated with the vulnerability (if relevant)
Your contact information, such as your organisation and contact name for ongoing communication

Rules of engagement

Please do not...

Take advantage of a security vulnerability.
Access, delete or modify Flare or client data.
Publicly disclose a vulnerability until it has been resolved.
Download more data than necessary to demonstrate a vulnerability.
Attempt to break into customer accounts.
Ask for compensation for your report.
Use Social Engineering, Denial of Service or Phishing attacks.

Excluded issues

The following items are known issues or accepted risks and are out of scope for this vulnerability reporting program.

Clickjacking.
SPF, DKIM, DMARC issues.
Missing additional security controls, such as HSTS or CSP headers.
Brute-force, / Rate-limiting, / Velocity throttling, and other denial of service based issues.
Any vulnerability found on the support.flarehr.com subdomain should be reported directly to Zendesk via their bug bounty program.

Next steps

Acknowledgements

Flare would like to thank the following researchers who have helped us improve security through our responsible disclosure program.

Akshay Parse
Barhaam
Cheripally Sathwik
Fabian Mucke
Gideon Cole
Jakia Akter sorna
Karl Aparece
Kinshuk Kumar
Kunal Narsale
Mohd Ali (revengerali)
Mohd Asif Khan
Netan Mangal
Pavan Baile
Sakshi Patil
Shubham Panchal
Yukesh Kumar

Novated leasing

Get started

Existing Flare member

Support

Flare Benefits

Get started

Solutions

Segments

Featured customers

Industries

Guides

Other Content

Existing customers

Contact us

Guides

Other Content

About Flare

Who we work with