Vulnerability Disclosure Policy

We welcome reports of security vulnerabilities in our service. Send reports to hello@bmk-hub.com. Include a description, steps to reproduce, and the impact. Machine-readable contact details: security.txt.

Scope

In scope: https://valinvo.bmk-hub.com and the API at https://valinvo.bmk-hub.com/v1/.

Out of scope: third-party services we use, including our hosting provider (Oracle Cloud) and our email provider (OVHcloud). We cannot authorise testing of their systems.

Please

• Test only with your own data or sample invoices. Never access, change or delete other people's data.
• Don't attach real invoices to your report.
• Stop and tell us as soon as you encounter personal data that isn't yours. Access only what you need to demonstrate the issue, and delete any data you obtained once you've reported it.
• Don't use real people's email addresses when testing the contact form.
• Don't run denial-of-service or load tests, social engineering, spam or physical attacks.
• Stay within the rate limits, and don't try to get around the free-trial limits.
• Give us 90 days before publishing, or less if we've fixed the issue and agree. If a fix is complex, we may ask for more time.
• Don't make disclosure or deletion conditional on payment.

Our commitments

• We will confirm receipt within 5 business days and keep you informed of progress.
• If you wish, we will credit you publicly once the issue is fixed.
• We do not offer monetary rewards.

Safe harbour

If you act in good faith and follow this policy:

• we consider your research authorised;
• we will not take or support legal action against you; and
• if a third party takes action against you, we will make it known that you acted under this policy.

This authorisation covers only systems within scope. It cannot bind public authorities or third parties.