Security mailbox
Email saar-security@heossi.com with the affected surface, reproduction steps and impact.
TrustHub · Disclosure
Vulnerability disclosure
If you believe you have found a security issue in Saar, report it privately. Please do not publish details before we have had a chance to respond.
security.txt
The RFC 9116 security.txt file is published with the current contact and policy route.
Scope
Include the product surface, version, environment and whether any data was exposed. Do not include third-party confidential data.
Acknowledgement
We aim to acknowledge a report and agree a handling path. No response or remediation SLA is promised on this page.
Coordinated disclosure
We will discuss timing and credit with the reporter. Public disclosure should follow agreement.
Out of scope
Social engineering, physical access and third-party services are handled through their own owners.
Boundary
Do not send customer data, secrets or production credentials in a report. Use a redacted reproduction.