Security at Squish

Reporting a vulnerability

Email security@squish.co with reproduction steps, the affected URL or endpoint, and any other detail that helps us validate the finding. PGP available on request.

We send a first response within one business day and provide a remediation timeline within 5 business days. Critical issues affecting customer data or money handling get same-day attention.

Our machine-readable contact info lives at https://squish.co/.well-known/security.txt.

Safe harbor

We won't pursue legal action against good-faith security research that:

• Doesn't access, modify, or destroy other customers' data
• Doesn't degrade service for other users (no DoS / load testing)
• Doesn't violate applicable laws beyond what's necessary to demonstrate the issue
• Reports the issue to us privately before public disclosure

If your research goes sideways and you're worried, contact us — we'd rather hear from you early than late.

In scope

• squish.co — public marketing site, dashboard, checkout
• work.squish.co — internal CRM (gated behind Cloudflare Access)
• api.squish.co — backend API
• crm-api.squish.co — internal CRM API (gated)

Out of scope

• Denial-of-service, volumetric, or load-testing attacks
• Social engineering of staff or customers
• Physical attacks against our offices or staff
• Findings on third-party services we use (Stripe, Firebase, Salesforce, NameSilo, Pax8, Cloudflare) — please report to those vendors directly
• Self-XSS, missing security headers without demonstrable impact, or theoretical issues without a working reproduction
• Reports from automated scanners without manual verification

Bounty

We don't currently run a paid bug-bounty program. We will gladly credit you publicly (with your permission) on this page once any reported issue is fixed.

We'll evaluate moving to a structured bounty program post-launch. Until then, sincere thanks is the official compensation — and a real one, given the size of our team.

What we do on our side

• Defense in depth. Multiple layers of authentication, authorization, input validation, and rate limiting on every customer-facing surface.
• Least privilege. Staff access scoped to roles. No shared admin logins. MFA required on every sensitive platform.
• Audit logging. Every refund, impersonation session, and security-relevant rejection is logged for forensic review.
• Continuous hardening. Routine dependency vulnerability scans, regular self-assessments, and a published self-pen-test runbook.
• Stripe handles all card data. Squish never sees full card numbers — payment processing is PCI-compliant via Stripe Elements.
• Encryption in transit. All traffic is HTTPS-only with HSTS, TLS 1.2 minimum with TLS 1.3 support, and strong ciphers (SSL Labs A+, verified July 2026).