Responsible vulnerability disclosure
If you have found a security vulnerability in Rakon Cloud or in one of the Rakon applications, please report it to us before telling anyone else. We take every report seriously.
How to report
Write to security@rakon.cloud. Describe the issue, the steps to reproduce it, the page or address where it occurs and what an attacker could achieve. A screenshot or a short proof of concept is welcome. Do not send us other people's personal data you came across.
Scope
rakon.cloud and every application on its subdomains (*.rakon.cloud), including sign-in, organizations and application access. Third-party services we use are out of scope; report issues in them to those providers.
What we ask of you
- Access only your own accounts and data; if you see someone else's data by accident, stop, do not keep it and tell us.
- Do not change or delete data and do not disrupt the service (no load testing, spam or large-scale automated scanning).
- No social engineering, physical access or attacks on our suppliers.
- Give us 90 days to fix the issue before you publish it; we can agree on a longer period if the fix is complex.
- Do not exploit the issue further than needed to prove it.
What we promise
- We confirm receipt within three business days and tell you who handles the report.
- We keep you informed and tell you when the issue is fixed.
- If you wish, we credit you as the person who reported it.
- We do not consider good-faith research that follows these rules an abuse of the service: we will not initiate or support legal action against you for it and will not report you, to the extent that depends on us.
What we do not treat as a vulnerability
Automated scanner findings without proof of impact, missing headers without a concrete attack, self-XSS, clickjacking on pages without sensitive actions and rate limiting on non-sensitive pages. We do not pay bounties at this time.
Non-security bugs
Report ordinary bugs and questions through in-app support or at contact@rakon.cloud.