Vulnerability disclosure policy

How to report

• Email security@rendro.net with what you found, the steps to reproduce it, and the impact you expect.
• We acknowledge reports within 3 business days and keep you updated until it's fixed.
• With your permission, we'll credit you once the issue is fixed.

In scope

• www.rendro.net and the Rendro application, including sign-in and the API routes it uses.
• Anything that could expose one workspace's data to another, or to someone outside it.

Please don't

• Access, change or delete data that isn't yours. Use your own test workspace.
• Run denial-of-service tests, spam, or automated scanning that degrades the service.
• Use social engineering or phishing against us or our customers.
• Test our providers (Vercel, Supabase and others) directly; report issues in their services to them.
• Share the issue publicly before we've had a reasonable time to fix it.

Our promise

If you act in good faith and follow this policy, we won't take legal action against you for your research, and we'll work with you to understand and fix the issue. We don't run a paid bug bounty.