ISO Mate is grateful to the security researchers who take the time to responsibly report vulnerabilities to us. Their work helps us keep our platform and our customers safe. This page recognizes the people who have made a valued contribution to the security of ISO Mate.
A Note on Compensation
ISO Mate does not currently operate a guaranteed paid bug bounty program. As an early-stage company, we are not yet in a position to offer immediate monetary rewards for vulnerability reports, and we want to be completely transparent about this.
However, we deeply value the security community and do not want your hard work to go unappreciated. We carefully track all valid submissions. While future payouts cannot be legally guaranteed today, it is our earnest goal to recognize these early contributions retrospectively as our company grows. ISO Mate reserves the right to issue discretionary, retroactive rewards to eligible researchers when our financial position allows.
Being listed here in our Security Hall of Fame serves as a permanent record of your invaluable contribution to our security and our gratitude for your help.
Responsible Disclosure
We ask that researchers give us a reasonable opportunity to investigate and remediate a reported issue before disclosing it publicly. To protect our customers, we only add a researcher and the details of their finding to this page after the vulnerability has been fully remediated. Entries are published with the researcher’s permission, and we are happy to credit you by name, handle, or anonymously, whichever you prefer.
Safe Harbor and Scope
We want researchers to test with confidence. If you act in good faith and follow our disclosure policy, we consider your research authorized and will not pursue legal action against you. The policy also sets out which systems are in scope, which are out of scope, and the testing activities we do not permit. Please review it before you begin: Vulnerability Disclosure Policy.
Recognized Researchers
The researchers below have responsibly disclosed vulnerabilities that we have since remediated. We add new entries here as reports are validated and fixed, with each researcher’s permission.
| Researcher | Vulnerability reported | Date recognized |
|---|---|---|
| Kolakaluri Abhishek | Registration disclosed whether an email address already had an account | September 2026 |
| Immadisetty Kiran Kumar | Sign-up answered differently for an email address that already had an account, which let an unauthenticated caller test whether a given address was registered | September 2026 |
| Karan Patil | Uploaded images retained EXIF metadata including GPS coordinates and device details | September 2026 |
| Kishore Baskaran | Adding an unregistered email address created an account and organization membership without the recipient's consent, and prevented the address owner from registering | September 2026 |
| Tippagalla Jaswanth | Embedded JavaScript in an uploaded PDF ran when the attachment was previewed | September 2026 |
| Kishore Baskaran | Organization creation limits could be stretched beyond the intended ceiling, allowing more concurrent free trials than the cap permitted | September 2026 |
| Suraj Dipak Bhujadi | Reported potential stored cross-site scripting in the task title field. Task titles are escaped everywhere they are shown, so the reported script execution did not apply. The report prompted a platform wide review that hardened search term handling and input length limits. | September 2026 |
| Kolakaluri Abhishek | Password reset send limit bypassed using case variants of the same email address | September 2026 |
| Sudarshan Kushwah | Email change verification links stayed valid after being superseded | September 2026 |
| Rudra tech services | Authenticated console content area failed to load after signing in | September 2026 |
| Thota Murari | Active API token limit exceeded through concurrent creation requests | September 2026 |
| CypherBinu | Sessions on other devices stayed active after enabling two-factor authentication | September 2026 |
| Atharva Savji Lokhande | Account lockout could be triggered remotely against any known email address | September 2026 |
| Shubham Mali | Account creation through Google sign-up without a Google verified identity | September 2026 |
| Gopinath S | Two-factor mobile number could be changed without re-authentication or verification | September 2026 |
| Lakhan Verma | The console stored the session token in browser local storage, where page scripts could read it | September 2026 |
| Amish Kumar | Reported an open redirect and stored cross-site scripting risk from SVG images uploaded to notes. Uploads are sanitized before they are stored, and notes strip SVG on both save and render, so the reported redirect did not apply. The report prompted fixes to missing file type checks and SVG sanitization on the ticket and email attachment upload paths. | September 2026 |
| Vaidik Pandya | Custom object type definitions readable and creatable across accounts | August 2026 |
| Omkar Dalavi | Access token remained valid after sign-out | August 2026 |
| Jahidul Hasan Munna | Broken function level authorization on dashboard endpoints | August 2026 |
| Jahidul Hasan Munna | Missing rate limiting on record creation allowing workspace flooding | August 2026 |
| Swatantra Kokare | Improper OAuth account binding after email address change | August 2026 |
| Manas Pipersaniya (VIT Bhopal University) | Missing security headers on statically served files | August 2026 |
| Aseeruddin Mulla | Missing account-level quota enforcement allowing uncontrolled user creation | August 2026 |
| Karan Patil | Stored cross-site scripting (XSS) in shared notes | August 2026 |
| Jebin Jose | No self-service recovery from the unverified email login block | August 2026 |
| Vijay Raghav | Stored HTML injection in note content | August 2026 |
| Sahil More | Host header injection allowing redirection to an arbitrary domain | August 2026 |
| Pramod Rathod | Active sessions not invalidated after password reset | August 2026 |
| Arjun Pandurang Tupe | Email verification bypass via Google OAuth sign-in | August 2026 |
| Pramod Rathod | Missing input length validation on the registration form | August 2026 |
| Umar (Stalker) | Missing rate limiting on user invitations allowing outbound mail abuse | August 2026 |
| Umar (Stalker) | Privilege escalation in account and role management | August 2026 |
| Umar (Stalker) | Improper privilege management in role delegation and account ownership | August 2026 |
| Umar (Stalker) | Stored cross-site scripting (XSS) via file attachment upload | August 2026 |
| Alagan_Infoziant | Unrestricted calendar creation allowing resource exhaustion | August 2026 |
| Mayuri S. Patwardhan | Missing Content-Security-Policy on the application console | July 2026 |
| Mayuri S. Patwardhan | Content-Security-Policy allowing inline scripts | July 2026 |
| Mayuri S. Patwardhan | Cookie set without a SameSite attribute | July 2026 |
| Mayuri S. Patwardhan | Deprecated X-XSS-Protection header returned | July 2026 |
| Mayuri S. Patwardhan | Missing cross-origin isolation response headers | July 2026 |
| Pathan Aslam | Unicode homoglyph email address spoofing | July 2026 |
| Pathan Aslam | Stored cross-site scripting (XSS) via logo upload | July 2026 |
| Pathan Aslam | Insufficient verification on account email change | July 2026 |
| Pathan Aslam | Active sessions not invalidated after password change | July 2026 |
| Pathan Aslam | Missing maximum password length validation | July 2026 |
| Pathan Aslam | Missing password change notification email | July 2026 |
| Pathan Aslam | Missing re-authentication for sensitive administrative actions (user deletion) | July 2026 |
| Soham D. Jadhav | Stored hyperlink injection | July 2026 |
| Team TrinityXploit | Username enumeration via login error messages | July 2026 |
| Omkar Yepre | Details kept private at the researcher’s request | July 2026 |
| Team TrinityXploit | User-controlled links reflected in notification emails | July 2026 |
| Kartik Kapil Lonkar | Uncontrolled resource consumption via scheduled-task endpoint | July 2026 |
| Sankalp Tripathi | Trial restriction bypass via email address aliases | July 2026 |
| Vivek Rajendra Udane | Unvalidated email recipient domains allowing outbound mail abuse | July 2026 |
| Akif Ali Khan | Web server version disclosure via Server header | July 2026 |
| Anonymous | Missing HTTP Strict Transport Security (HSTS) enforcement | June 2026 |
How to Report a Vulnerability
If you believe you have found a security vulnerability in ISO Mate, please email us at security@isomate.io with enough detail for us to reproduce and validate the issue. We will acknowledge your report, keep you informed as we investigate, and let you know once the issue is resolved. For the full rules of engagement, see our Vulnerability Disclosure Policy. For more information about how we protect your data, see our Security Practices page.
Contact
For anything related to security or responsible disclosure, please contact us at security@isomate.io.