Responsible disclosure policy

Version 2026-11-03 · We want to hear about security problems in 4colors services. If you think you have found one, please tell us. This page says how, what you may test, and what we promise in return.

How to report

Email security@4colors-research.com. Please include:

  • what you found and where (the address, endpoint or package version);
  • the steps to reproduce it;
  • what an attacker could do with it;
  • your name or handle, if you would like to be credited.

Please do not report security problems through public channels, such as GitHub issues or social media, until we have fixed them.

What is in scope

  • The 4colors API at api.4colors-research.com and the Account page.
  • The website at 4colors-research.com.
  • The fourcolors Python client published on PyPI.

What is out of scope

  • Denial of service, load or stress testing, and anything that slows the service down for other customers.
  • Social engineering, phishing, and physical attacks on our people or premises.
  • Services run by others that we use, such as Stripe, Google or GitHub sign-in, and our hosting and email providers. Report those to the provider.
  • Findings from automated scanners with no demonstrated impact, missing best-practice headers on their own, and self-XSS.
  • Testing plan limits, rate limits or trial limits by creating extra accounts or trials.

Rules for testing

When you test, you must:

  1. Use only accounts you created yourself, or accounts whose owner has agreed in writing.
  2. Never access, change or delete other customers' data. If you reach someone else's data by accident, stop, don't keep a copy, and tell us.
  3. Take only the minimum needed to show the problem, and don't keep any access after showing it.
  4. Not run jobs designed to use up execution time, capacity or storage.
  5. Give us reasonable time to fix the problem before telling anyone else. We ask for 90 days, or less if we have fixed it sooner.

What we promise

  • We acknowledge your report within 5 working days and tell you whether we can reproduce it.
  • We keep you informed until the problem is fixed.
  • If you followed this policy in good faith, we will not take legal action against you, and we will not ask the police to investigate your testing. Testing that follows this policy is authorized use under section 9 of our Terms of Service.
  • With your agreement, we credit you when we publish the fix.

We don't pay rewards for reports at present.

Contact

4colors Ltd, trading as 4colors Research. Registered in England and Wales, company number 10139486. Registered office: 71-75 Shelton Street, Covent Garden, London WC2H 9JQ, United Kingdom. Security reports: security@4colors-research.com

Questions about these documents? Contact us.