Vulnerability disclosure
Found a flaw? We want to hear first.
Good-faith security research protects our customers. This policy says what you may test, how to report and what each side commits to.
In effect since 09/2026
01Scope
What you may test.
It covers what Indene itself operates: the indene.io site, its subdomains and the Indene platform. Third-party services we use, such as the Cloudflare edge, follow that vendor's own policy.
- In scope: flaws that expose data, break isolation between organizations, execute code or bypass authentication and authorization.
- Out of scope: denial of service, social engineering, phishing against the team and physical access.
- Also out: automated scanner reports without demonstrated impact, missing headers or email records without an exploitable scenario, and clickjacking on pages without sensitive actions.
02How to report
A report we can reproduce.
Write to security@indene.io in English, Portuguese or Spanish. The easier it is to reproduce, the faster the fix ships.
- Describe the flaw, the affected asset and the impact you were able to demonstrate.
- Include the steps to reproduce, with requests, screenshots or a proof of concept.
- Do not attach personal or customer data you saw: describe what you accessed and delete the copy.
03Good-faith rules
Prove the problem, then stop.
We ask that research causes the least possible effect. Once the flaw is confirmed, stop there and tell us.
- Use only your own accounts or accounts created for the test. Do not access, change or delete anyone else's data.
- Do not degrade the service: no load testing, no spam and no aggressive automation.
- Do not disclose the flaw before the fix or before the deadline agreed with us.
04Our commitments
Deadlines you can hold us to.
Every report gets an answer from a person. You will know what we decided, when we fixed it and when you may publish.
- Acknowledgement of receipt within 3 business days.
- Initial assessment, with the severity we assign and why, within 10 business days.
- Coordinated disclosure: the date is agreed with you, with 90 days from the report as the reference.
05Safe harbor
Good-faith research does not become a lawsuit.
If you follow this policy, we consider your research authorized. We will not take legal action against you or support anyone who wants to; if someone does, we will confirm in writing that your activity followed this policy.
- There is no cash reward today. When a program exists, it will be announced on this page.
- With your permission, we thank you publicly by the name or handle you choose.
- If you are unsure about scope, ask before testing.
Ready to report?
One email is enough. If the report contains sensitive information, say so in the first message and we will agree on an encrypted channel before the details.