Vulnerability Disclosure Policy

How to report

Email security@klosemore.com, in English, with:

• what you found and where;
• the steps to reproduce it;
• what an attacker could do with it;
• whether you want us to credit you, and under what name.

Our address is also in klosemore.com/.well-known/security.txt.

What we promise

• We aim to confirm we received your report within 3 Latvian business days.
• We tell you how the fix is going.
• We credit you when it is fixed, if you want us to.
• We take no legal action against research done in good faith that follows this policy, and we treat it as authorised. We cannot speak for the authorities or for the services we use, so stay within the scope below.

Keeping it private while we fix it

Keep the details between us until we have fixed the problem or 90 days have passed since your report, whichever comes first. After that you may publish. If a fix needs longer, we may ask you for more time and say why, and you decide.

Rules for testing

• Test only with accounts and workspaces that are yours.
• Stop at the least needed to show the problem; never read more than a handful of records.
• Do not read, change or delete anyone else's data. If you reach it by accident, stop, and tell us what you saw.
• No denial of service, no spam, no social engineering of our people or customers, and no physical attacks.
• Do not keep data you reach, and delete it once you have reported.

What is in scope

In scope: klosemore.com, www.klosemore.com and app.klosemore.com.

Out of scope: the services we use, such as Vercel, Clerk, AWS, Google or Pipedrive, including the sign-in pages Clerk runs for us at clerk.klosemore.com and accounts.klosemore.com. Report those to them.

Not counted, because on their own they put no one's data at risk:

• missing security headers or email records such as SPF and DMARC, with no attack shown;
• clickjacking on pages with no action worth tricking;
• attacks that need a compromised device or an out-of-date browser, or that only work against yourself;
• results from automated scanners you have not confirmed.

Rewards

We do not run a paid bug bounty. We thank and credit everyone who reports a real problem.