Safetica vulnerability disclosure policy

Reporting a vulnerability

At Safetica, we take security seriously. If you believe you have discovered a security vulnerability in any Safetica product or service, please report it to us responsibly.

How to report

Please send details to: security@safetica.com

• We recommend encrypting your message using our public key to protect sensitive vulnerability information:
  • https://pki.safetica.com/.well-known/security-at-safetica.pub

Include as much information as possible:

• Description of the vulnerability
• Affected product and version
• Steps to reproduce (if applicable)
• Potential impact
• Any proof-of-concept or supporting materials

Please do not publicly disclose the vulnerability until we have had an opportunity to investigate and address the issue.

What to expect

• We will acknowledge receipt of your report within 5 business days.
• We will investigate the issue and may contact you for additional information.
• If confirmed, we will work to remediate the vulnerability in accordance with our internal security and release processes.
• If not confirmed, we will inform you why we do not think/consider it is a vulnerability.
• Reward – No bug bounty, just fame.

We appreciate responsible disclosure and the efforts of security researchers who help us improve the safety of our products.