Vulnerability disclosure policy

How to report

Email info@sentinelleai.app with a subject starting [security]. Please include:

• the affected URL or endpoint;
• the steps to reproduce;
• a proof of concept showing the impact;
• your contact details for follow-up.

What we commit to

• We acknowledge your report within 5 business days.
• We keep you informed while we investigate and fix.
• Once it is fixed, we credit you on this page if you wish.
• We do not run a paid bounty program, so no payment is made for reports.

In scope

• sentinelleai.app and its subdomains;
• the public API under sentinelleai.app/api.

Out of scope

• Third-party services we use (payment, email, sign-in providers): report to them directly.
• Denial of service and load testing.
• Social engineering, phishing of staff or customers, and physical attacks.
• Spam or brute force of sign-in.
• Reports from automated scanners without demonstrated impact.
• Missing best-practice headers or cookie flags without a concrete exploit.
• Using our scanning product against systems you do not own or are not authorised to test.

Rules for testing

• Test only with accounts you own.
• Do not access, modify or keep other users' data beyond the minimum needed to show the issue. If you see someone else's data, stop and report immediately.
• Do not degrade the service.
• Give us 90 days, or until a fix ships, whichever comes first, before any public disclosure, and coordinate the disclosure with us.

Safe harbour

If you act in good faith and follow these rules, we will consider your research authorised, we will not pursue or support legal action against you for it, and we will work with you to understand and fix the issue quickly. This does not authorise testing of third-party systems and cannot waive the rights of third parties.