ISO Mate agradece a los investigadores de seguridad que se toman el tiempo de reportarnos vulnerabilidades de forma responsable. Su trabajo nos ayuda a mantener seguras nuestra plataforma y a nuestros clientes. Esta página reconoce a las personas que han hecho una valiosa contribución a la seguridad de ISO Mate.
Una nota sobre la compensación
Actualmente ISO Mate no opera un programa de recompensas por errores (bug bounty) pagado y garantizado. Como empresa en etapa temprana, todavía no estamos en posición de ofrecer recompensas monetarias inmediatas por los reportes de vulnerabilidades, y queremos ser completamente transparentes al respecto.
Sin embargo, valoramos profundamente a la comunidad de seguridad y no queremos que su arduo trabajo pase desapercibido. Registramos cuidadosamente todos los envíos válidos. Aunque hoy no podemos garantizar legalmente pagos futuros, es nuestro objetivo sincero reconocer estas primeras contribuciones de forma retrospectiva a medida que nuestra empresa crezca. ISO Mate se reserva el derecho de otorgar recompensas discrecionales y retroactivas a los investigadores elegibles cuando nuestra situación financiera lo permita.
Aparecer aquí, en nuestro Salón de la Fama de Seguridad, sirve como un registro permanente de su invaluable contribución a nuestra seguridad y de nuestra gratitud por su ayuda.
Divulgación responsable
Pedimos a los investigadores que nos den una oportunidad razonable para investigar y remediar un problema reportado antes de divulgarlo públicamente. Para proteger a nuestros clientes, solo añadimos a un investigador y los detalles de su hallazgo a esta página después de que la vulnerabilidad haya sido completamente remediada. Las entradas se publican con el permiso del investigador, y con gusto lo acreditaremos por nombre, alias o de forma anónima, según prefiera.
Protección legal y alcance
Queremos que los investigadores prueben con confianza. Si actúa de buena fe y sigue nuestra política de divulgación, consideramos que su investigación está autorizada y no emprenderemos acciones legales en su contra. La política también define qué sistemas están dentro del alcance, cuáles quedan fuera y las actividades de prueba que no permitimos. Por favor, revísela antes de comenzar: Política de Divulgación de Vulnerabilidades.
Investigadores reconocidos
Los investigadores a continuación han divulgado de forma responsable vulnerabilidades que desde entonces hemos remediado. Añadimos nuevas entradas aquí a medida que los reportes se validan y corrigen, con el permiso de cada investigador.
| Researcher | Vulnerability reported | Date recognized |
|---|---|---|
| Kolakaluri Abhishek | Registration disclosed whether an email address already had an account | September 2026 |
| Immadisetty Kiran Kumar | Sign-up answered differently for an email address that already had an account, which let an unauthenticated caller test whether a given address was registered | September 2026 |
| Karan Patil | Uploaded images retained EXIF metadata including GPS coordinates and device details | September 2026 |
| Kishore Baskaran | Adding an unregistered email address created an account and organization membership without the recipient's consent, and prevented the address owner from registering | September 2026 |
| Tippagalla Jaswanth | Embedded JavaScript in an uploaded PDF ran when the attachment was previewed | September 2026 |
| Kishore Baskaran | Organization creation limits could be stretched beyond the intended ceiling, allowing more concurrent free trials than the cap permitted | September 2026 |
| Suraj Dipak Bhujadi | Reported potential stored cross-site scripting in the task title field. Task titles are escaped everywhere they are shown, so the reported script execution did not apply. The report prompted a platform wide review that hardened search term handling and input length limits. | September 2026 |
| Kolakaluri Abhishek | Password reset send limit bypassed using case variants of the same email address | September 2026 |
| Sudarshan Kushwah | Email change verification links stayed valid after being superseded | September 2026 |
| Rudra tech services | Authenticated console content area failed to load after signing in | September 2026 |
| Thota Murari | Active API token limit exceeded through concurrent creation requests | September 2026 |
| CypherBinu | Sessions on other devices stayed active after enabling two-factor authentication | September 2026 |
| Atharva Savji Lokhande | Account lockout could be triggered remotely against any known email address | September 2026 |
| Shubham Mali | Account creation through Google sign-up without a Google verified identity | September 2026 |
| Gopinath S | Two-factor mobile number could be changed without re-authentication or verification | September 2026 |
| Lakhan Verma | The console stored the session token in browser local storage, where page scripts could read it | September 2026 |
| Amish Kumar | Reported an open redirect and stored cross-site scripting risk from SVG images uploaded to notes. Uploads are sanitized before they are stored, and notes strip SVG on both save and render, so the reported redirect did not apply. The report prompted fixes to missing file type checks and SVG sanitization on the ticket and email attachment upload paths. | September 2026 |
| Vaidik Pandya | Custom object type definitions readable and creatable across accounts | August 2026 |
| Omkar Dalavi | Access token remained valid after sign-out | August 2026 |
| Jahidul Hasan Munna | Broken function level authorization on dashboard endpoints | August 2026 |
| Jahidul Hasan Munna | Missing rate limiting on record creation allowing workspace flooding | August 2026 |
| Swatantra Kokare | Improper OAuth account binding after email address change | August 2026 |
| Manas Pipersaniya (VIT Bhopal University) | Missing security headers on statically served files | August 2026 |
| Aseeruddin Mulla | Missing account-level quota enforcement allowing uncontrolled user creation | August 2026 |
| Karan Patil | Stored cross-site scripting (XSS) in shared notes | August 2026 |
| Jebin Jose | No self-service recovery from the unverified email login block | August 2026 |
| Vijay Raghav | Stored HTML injection in note content | August 2026 |
| Sahil More | Host header injection allowing redirection to an arbitrary domain | August 2026 |
| Pramod Rathod | Active sessions not invalidated after password reset | August 2026 |
| Arjun Pandurang Tupe | Email verification bypass via Google OAuth sign-in | August 2026 |
| Pramod Rathod | Missing input length validation on the registration form | August 2026 |
| Umar (Stalker) | Missing rate limiting on user invitations allowing outbound mail abuse | August 2026 |
| Umar (Stalker) | Privilege escalation in account and role management | August 2026 |
| Umar (Stalker) | Improper privilege management in role delegation and account ownership | August 2026 |
| Umar (Stalker) | Stored cross-site scripting (XSS) via file attachment upload | August 2026 |
| Alagan_Infoziant | Unrestricted calendar creation allowing resource exhaustion | August 2026 |
| Mayuri S. Patwardhan | Missing Content-Security-Policy on the application console | July 2026 |
| Mayuri S. Patwardhan | Content-Security-Policy allowing inline scripts | July 2026 |
| Mayuri S. Patwardhan | Cookie set without a SameSite attribute | July 2026 |
| Mayuri S. Patwardhan | Deprecated X-XSS-Protection header returned | July 2026 |
| Mayuri S. Patwardhan | Missing cross-origin isolation response headers | July 2026 |
| Pathan Aslam | Unicode homoglyph email address spoofing | July 2026 |
| Pathan Aslam | Stored cross-site scripting (XSS) via logo upload | July 2026 |
| Pathan Aslam | Insufficient verification on account email change | July 2026 |
| Pathan Aslam | Active sessions not invalidated after password change | July 2026 |
| Pathan Aslam | Missing maximum password length validation | July 2026 |
| Pathan Aslam | Missing password change notification email | July 2026 |
| Pathan Aslam | Missing re-authentication for sensitive administrative actions (user deletion) | July 2026 |
| Soham D. Jadhav | Stored hyperlink injection | July 2026 |
| Team TrinityXploit | Username enumeration via login error messages | July 2026 |
| Omkar Yepre | Details kept private at the researcher’s request | July 2026 |
| Team TrinityXploit | User-controlled links reflected in notification emails | July 2026 |
| Kartik Kapil Lonkar | Uncontrolled resource consumption via scheduled-task endpoint | July 2026 |
| Sankalp Tripathi | Trial restriction bypass via email address aliases | July 2026 |
| Vivek Rajendra Udane | Unvalidated email recipient domains allowing outbound mail abuse | July 2026 |
| Akif Ali Khan | Web server version disclosure via Server header | July 2026 |
| Anonymous | Missing HTTP Strict Transport Security (HSTS) enforcement | June 2026 |
Cómo reportar una vulnerabilidad
Si cree haber encontrado una vulnerabilidad de seguridad en ISO Mate, escríbanos a security@isomate.io con suficiente detalle para que podamos reproducir y validar el problema. Confirmaremos la recepción de su reporte, lo mantendremos informado mientras investigamos y le avisaremos una vez que el problema esté resuelto. Para conocer las reglas completas de participación, consulte nuestra Política de Divulgación de Vulnerabilidades. Para más información sobre cómo protegemos sus datos, consulte nuestra página de Prácticas de Seguridad.
Contacto
Para cualquier asunto relacionado con la seguridad o la divulgación responsable, contáctenos en security@isomate.io.