Doowings

Vulnerability Disclosure Policy

Last updated: 2026-10-02

Doowings welcomes reports from anyone who believes they have found a security vulnerability in our services. This page explains how to reach us, what is in scope, how we ask you to test, and what you can expect from us in return.

How to report

Email [email protected]. You can write in English or French.

A useful report includes:

  • the affected service, URL or extension version
  • a description of the issue and its likely impact
  • step-by-step instructions or a proof of concept that lets us reproduce it
  • any accounts, request IDs or timestamps involved, so we can find the activity in our logs
  • how you would like to be credited, if at all

Our contact details are also published in machine-readable form at /.well-known/security.txt.

Scope

This policy covers the services Doowings operates under doowings.com, including:

  • the Doowings Hire web application, including its public careers pages and legal pages
  • the Doowings for LinkedIn Chrome extension
  • the API that serves them

Our customers' workspaces hold real people's data, which our customers control, and you cannot create a workspace yourself. To test, ask us for a test tenant at the address above. Never test against a customer's tenant or data.

Rules of engagement

To stay within this policy, please:

  • test only in a test tenant we have provided to you, with the accounts and data in it
  • never test against a customer's tenant, account or data
  • stop testing and report to us as soon as you gain access to anyone else's data, and do not keep, copy or share that data
  • do not run denial-of-service tests or anything else that degrades the service for other users
  • do not use social engineering, phishing or physical attacks against our staff, customers or offices
  • do not send spam or bulk messages through our services
  • do not submit raw scanner output without a proof of concept showing a real impact
  • give us a reasonable chance to fix the issue before telling anyone else about it

Safe harbour

If you act in good faith and follow this policy, we consider your research authorised, to the extent we are able to authorise it. We will not pursue legal action against you for it, and we will not ask anyone else to. We cannot authorise access to our customers' data, which they control, so this safe harbour does not cover testing against it. If a third party brings a claim related to research that followed this policy, we will make it known that your work was authorised.

If you are unsure whether something you want to try is allowed, ask us first at the address above.

Our commitments

When you report a vulnerability to us, we will:

  • acknowledge your report within 5 business days
  • keep you informed as we investigate and fix the issue
  • coordinate public disclosure with you; by default we ask for 90 days from your report before details are published, and we may agree a different timeline with you when a fix needs more or less time
  • credit you for the finding if you would like us to

We do not currently offer a monetary bounty.

Out of scope

These are not covered by this policy:

  • credential stuffing, password spraying or other brute-force attempts against any sign-in, including the administration console
  • hosts under doowings.com that are operated by third parties rather than by Doowings
  • LinkedIn's own platform and the services of our vendors

If you find a vulnerability in a third party's service, please report it to that company directly.