Vulnerability Disclosure Policy

In scope

• saar.heossi.com and portal.saar.heossi.com
• Public Saar APIs and authentication flows
• Hosted compression, restore and download paths
• Organization, SSO, domain verification and API key controls
• The content of this website and its published evidence

Out of scope

• Denial-of-service, load or stress testing
• Social engineering, phishing or physical attacks
• Third-party services, including Vercel, Supabase and Stripe
• Reports requiring access to another customer's data
• Automated scanner output without a demonstrated impact
• Best-practice or missing-header reports with no exploitable impact

Reporting

Email saar-security@heossi.com with a clear description, reproduction steps, affected URL or endpoint, impact, and any proof of concept. Do not include passwords, API keys, personal data or customer files. If you need encrypted email, ask for a key exchange first.

We aim to acknowledge within two business days, provide an initial assessment within five business days and keep you informed of remediation. These are aims, not guaranteed times.

Safe harbour

If you act in good faith, stay within scope, avoid privacy violations, data destruction and service disruption, and give us reasonable time to fix the issue before disclosure, HEOSSI will not pursue legal action for the research itself. This does not waive any rights against unrelated misuse.

Security contact: saar-security@heossi.com. Security.txt: /.well-known/security.txt.