Vulnerability Disclosure Policy

Effective Date: 23 July 2026
Last Updated: 23 July 2026
Version: 1.0

Introduction

ISO Mate is grateful to the security researchers who take the time to responsibly report vulnerabilities to us. Your efforts directly help us protect our platform, our systems, and our customers. This policy outlines our vulnerability disclosure program, legal safe harbor guidelines, and the process for reporting security issues.

Legal Safe Harbor

If you conduct your vulnerability research in good-faith compliance with this policy, we consider your research to be authorized. ISO Mate will not initiate or support legal action against you regarding your security research activities, provided you adhere strictly to these guidelines.

Scope

In-Scope Systems

The following assets are eligible for security testing under this policy:

  • Primary web applications: console.isomate.io and isomate.io
  • Public APIs: Any official API endpoints hosted on api.isomate.io domain assets

Out-of-Scope Systems and Vulnerabilities

The following assets and issues are outside the formal scope of this policy:

  • Third-party services, vendors, or hosted integrations (e.g., identity providers, analytics services)
  • Physical security of ISO Mate offices or facilities
  • Employee devices, corporate email, or internal infrastructure
  • Volumetric Distributed Denial of Service (DDoS) testing
  • Missing best practices (e.g., HTTP security headers, SSL/TLS configuration) without a demonstrable exploit path

Note: while missing security best practices without a demonstrable exploit path fall outside the formal scope above, we still value hardening research. ISO Mate may, at its discretion, recognize impactful best-practice and hardening findings in our Security Hall of Fame even when they do not qualify for other consideration.

Prohibited Testing Activities

To protect our platform and customer data, the following activities are strictly prohibited:

  • Denial of Service (DoS/DDoS attacks) or deliberate disruption of system availability
  • Data modification, destruction, or exfiltration beyond what is minimally required to demonstrate a vulnerability
  • Social engineering, phishing, or physical attacks targeting ISO Mate employees or users
  • Privacy violations or accessing unauthorized customer data
  • Executing automated scanning tools that generate high volumes of traffic

How to Report a Vulnerability

If you believe you have discovered a security vulnerability in an ISO Mate asset, please email us immediately at security@isomate.io.

Please include the following in your report

  • Description: A clear explanation of the vulnerability and its potential impact.
  • Reproduction steps: Step-by-step instructions or scripts to reliably reproduce the issue.
  • Proof of Concept (PoC): Screenshots or evidence demonstrating the issue safely, without causing system downtime or accessing sensitive user data.

Response Expectations (SLA)

We commit to acting in good faith and communicating openly with researchers throughout the report lifecycle:

  • Acknowledgment: We aim to acknowledge receipt of your report within 3 business days.
  • Triage and validation: We strive to validate and triage submitted issues within 10 business days.
  • Updates and remediation: We will keep you updated on our progress toward resolving the issue.

Compensation and Discretionary Recognition

ISO Mate does not currently operate a guaranteed paid bug bounty program. As an early-stage company, our platform testing relies on voluntary disclosures.

However, we deeply value the security community. Submissions are tracked, and while monetary rewards are not guaranteed, ISO Mate reserves the right to offer discretionary retroactive rewards or tokens of appreciation to eligible researchers as our company and security program mature.

Security Hall of Fame

Every researcher who responsibly discloses a valid, verified vulnerability is eligible for public recognition in our Security Hall of Fame.

Recognition Options

  • Named recognition: Credited by your real name or online professional handle.
  • Anonymous recognition: Credited anonymously.
  • No recognition: You may choose not to be listed.

Identity Verification

If you opt for named public recognition, we may request a link to a professional profile (such as LinkedIn, GitHub, or X/Twitter) to verify your handle prior to publishing.

Contact

For any questions regarding this policy or to report a security issue, please contact us at security@isomate.io.