Responsible disclosure
If you have found a vulnerability in Ichnaro, we want to hear from you.
Reporting a vulnerability
Email security@ichnaro.com (PGP key at /.well-known/pgp-key.txt). Please include affected URLs or components, steps to reproduce, and impact.
Scope
ichnaro.com, app.ichnaro.com, api.ichnaro.com.
Out of scope
Denial-of-service testing, social engineering of staff or clients, physical attacks, automated scanning that degrades service, third-party services (Cloudflare, Google, Stripe) — report those to the vendor.
Rules
Do not access, modify or retain data belonging to others. If you encounter case data, evidence or personal data, stop, do not download it, and tell us immediately. Do not attempt to modify or delete any evidence artefact or audit record. Give us reasonable time to fix before any disclosure (default 90 days, sooner by agreement).
Our commitments
Acknowledge within 3 business days; initial assessment within 10 business days; keep you informed; credit you (if you wish) once fixed.
Safe harbour
If you act in good faith and follow these rules, we will not pursue or support legal action against you for your research.
Bug bounty
We do not run a paid bug bounty. With your agreement, we credit researchers once a fix is released.