Reporting vulnerabilities
Email info@worklinker.com with details of the issue, steps to reproduce, and the impact. We respond within 48 hours.
We will not pursue legal action against researchers who act in good faith, stay within scope below, and do not access other customers' data.
What we protect
- Personal data about workers is used and kept as their employer decides, under the data-protection law that applies to that employer. Workers ask their employer to see, correct or delete it.
- Medical and occupational-health records stay inside the company they belong to, isolated by the same row-level security as the rest of that company's data.
- Row-level security isolates every client's data on Postgres.
- Two-factor authentication is available for administrators.
In scope
- app.filaway.com and any other filaway.com subdomain serving Filaway.
- Public API endpoints under /api.
- Mobile web experience for drivers, inspectors and workers.
Out of scope
- Social engineering of staff or customers.
- Denial of service, rate limit abuse, volumetric attacks.
- The infrastructure of the third-party service providers we depend on (report those to the provider directly).
- Issues already documented as known limitations.
Recognition
We do not currently run a paid bug bounty. Valid reports are credited publicly on this page (with your consent) and earn an Filaway thank-you pack.