Merge pull request #3636 from gratipay/HackerOne

redirect Security to our HackerOne profile

templates/about-security.html

@@ -3,7 +3,7 @@
     {% set current_page = request.path.raw.split('/')[3] %}
     {% set nav_base = '/about/security' %}
     {% set pages = [ ('/', _('Disclosure'))
-                   , ('/hall-of-fame', _('Hall of Fame'))
+                   , ('/hall-of-fame', _('Hall of Fame (Legacy)'))
                     ] %}
     {% include "templates/nav.html" %}
 {% endblock %}

www/about/security/hall-of-fame.spt

@@ -62,13 +62,20 @@ for line in raw.splitlines():
 
 [---]
 title = _("Security")
-subhead = _("Hall of Fame")
+subhead = _("Hall of Fame (Legacy)")
 [---] text/html
 {% extends "templates/about-security.html" %}
 {% block content %}
 <div class="col0">
-    <p>Thank you to the following researchers (most recent first) for
-    <a href="./">disclosing</a> security issues to us.</p>
+
+    <p><b>Note:</b> We now prefer to <a
+        href="https://hackerone.com/gratipay/thanks">thank researchers on
+    HackerOne</a>. This is our legacy Hall of Fame.</p>
+
+    <p>Thank you to the following researchers (most recent first) for <a
+        href="https://hackerone.com/gratipay">disclosing</a> security issues to
+    us outside of HackerOne.</p>
+
 </div>
 <div class="hall-of-fame">
     <dl>

www/about/security/index.spt

@@ -1,80 +1,3 @@
-# encoding: utf8
-from gratipay.utils import markdown
 [---]
-title = _("Security")
+website.redirect('https://hackerone.com/gratipay', base_url='')
 [---] text/html
-{% extends "templates/about-security.html" %}
-{% block content %}
-
-<div class="col0">
-
-{{ markdown.render("""
-
-We take the security of our systems seriously, and we value the security community. The responsible disclosure of security vulnerabilities helps us ensure the security and privacy of our users.
-
-## Guidelines
-
-We ask that all researchers:
-
-* Make every effort to avoid privacy violations, degradation of user experience, disruption to production systems, and destruction of data during security testing;
-* Perform research only within the scope set out below;
-* Use the identified communication channels to report vulnerability information to us; and
-* Keep information about any vulnerabilities you’ve discovered confidential between yourself and Gratipay until we’ve had 90 days to resolve the issue.
-
-If you follow these guidelines when reporting an issue to us, we commit to:
-
-* Not pursue or support any legal action related to your research;
-* Work with you to understand and resolve the issue quickly (including an initial confirmation of your report within 72 hours of submission);
-* Recognize your contribution on our Security Researcher [Hall of Fame](./hall-of-fame), if you are the first to report the issue and we make a code or configuration change based on the issue.
-
-## Scope
-
-* https://gratipay.com
-
-Source code is [available on GitHub](https://github.com/gratipay/gratipay.com).
-
-## Out of scope
-
-Any services hosted by 3rd party providers and services are excluded from scope.
-
-In the interest of the safety of our users, staff, the Internet at large and you as a security researcher, the following test types are excluded from scope:
-
-* Findings from physical testing such as office access (e.g. open doors, tailgating)
-* Findings derived primarily from social engineering (e.g. phishing, vishing)
-* Findings from applications or systems not listed in the ‘Scope’ section
-* UI and UX bugs and spelling mistakes
-* Network level Denial of Service (DoS/DDoS) vulnerabilities
-
-Things we do not want to receive:
-
-* Personally identifiable information (PII)
-* Credit card holder data
-
-## How to Report a Security Vulnerability
-
-If you believe you’ve found a security vulnerability in one of our products or platforms please send it to us by emailing [email protected]. Please include the following details with your report:
-
-* Description of the location and potential impact of the vulnerability;
-* A detailed description of the steps required to reproduce the vulnerability (POC scripts, screenshots, and compressed screen captures are all helpful to us); and
-* Your name/handle and a link for recognition in our Hall of Fame.
-
-To encrypt your message, you may use [our PGP key](pgp.asc):
-""") }}
-
-<pre>
-$ curl https://gratipay.com/about/security/pgp.asc | gpg --import
-gpg: key 7A5F6B30: "Gratipay Security &lt;[email protected]&gt;" imported
-gpg: Total number processed: 1
-gpg:               imported: 1
-$
-</pre>
-
-{{ markdown.render("""
-
-We only use PGP to decrypt messages, never to encrypt messages or authenticate our identity. Instead, we'll create a private repository on GitHub for ongoing communication about the vulnerability, which we'll invite you to join (see our [internal policy document](http://inside.gratipay.com/howto/handle-security-issues) for more details).
-
-""") }}
-
-</div>
-
-{% endblock %}