Vulnerability Disclosure Policy
Updated: September 2026
Found something that looks like a security vulnerability? We want to hear about it, and we would rather hear it from you than from someone else. This page explains how to report and what we commit to.
What we commit to
- Acknowledging your report within three business days
- Keeping you updated on progress until it is closed
- Taking no legal action against anyone acting in good faith under this policy
- Crediting the reporter, if they want credit
What we ask of you
- Give us reasonable time to fix the issue before public disclosure
- Do not access, modify or delete other customers' data
- Use your own test account rather than a customer's
- Do not run load or denial-of-service tests against the live environment
- Include steps to reproduce, so we can verify quickly
Out of scope
- Findings from automated scanning alone, with no proof of exploitability
- A missing security header with no demonstrated practical impact
- Social engineering of our staff or our customers
- Library version reports with no actual exploitation path
How to report
Send the details to support@contento.team