CtrlOps Vulnerability Disclosure Policy

We welcome reports from security researchers acting in good faith. We will read every report, work with you, fix valid issues promptly, and treat you with respect throughout. This policy is our open invitation to help us keep CtrlOps and its users safe.

Please email your report to support@ctrlops.io with the subject line starting "Security:".

To help us act quickly, try to include:

• A clear description of the issue and the impact you think it has
• Steps to reproduce it, as detailed as you can
• The affected area (for example, a URL, or the app and version)
• Any proof of concept, screenshots, or logs that help
• How we can reach you for follow-up

You do not need a fancy format. A clear plain-text email is perfect.

You may test and report issues on:

• ctrlops.io and its subdomains
• The CtrlOps desktop application

Please do not test or report the following:

• Third-party services we use, such as Razorpay, Creem, Brevo, Mixpanel, Tawk.to, and Google. Report those to the vendor directly.
• Social engineering of our team, customers, or vendors
• Physical attacks against our staff or offices
• Denial-of-service (DoS) testing or anything that degrades or disrupts the service

Some reports usually do not qualify on their own, unless you can show a real, working security impact: results from automated scanners with no proof of concept, missing "best practice" security headers, self-XSS, clickjacking on pages with no sensitive action, rate-limiting suggestions, and reports of outdated software versions without a demonstrated exploit.

To keep your research in good faith, please:

• Do no harm. Do not access, change, delete, or save data that is not yours.
• Respect privacy. If you come across someone else's personal data, stop, and tell us.
• Do not disrupt the service or degrade the experience for other users.
• Only test what is in scope, and only your own accounts and data.
• Report promptly once you find something, and do not stockpile issues.
• Do not extort. Threatening to release or withhold a report for payment is not good-faith research and is not covered by this policy.

Please keep any issue you find confidential and do not disclose it publicly, in whole or in part, without our prior written consent. We will work with you on if and when anything can be shared. In return, we commit to fixing valid issues promptly and keeping you updated until they are resolved.

This is the important part. If you make a good-faith effort to follow this policy, we consider your security research authorized.

• We will not pursue or support legal action against you for research that follows this policy.
• We will treat your actions as authorized under the laws that would otherwise restrict them.
• If someone else brings a claim against you for activity that followed this policy, we will make it known that your actions were authorized by us.

If you are ever unsure whether something is allowed, ask us first at support@ctrlops.io, and we will be glad to clarify.

When you report in line with this policy, we will:

• Acknowledge your report within 3 business days
• Give you a first assessment within 10 business days
• Keep you updated as we investigate and fix the issue
• Credit you publicly for the discovery, if you would like that

We do not run a fixed cash bug bounty. What we do offer:

• A genuine thank-you and public credit for researchers who report responsibly, if you want it
• Any reward is decided case by case through mutual discussion, and may include CtrlOps plans or licenses as a token of our thanks

Our appreciation for good-faith research is real, and we will always try to recognize it fairly.

We may update this policy from time to time. When we do, we will update the "Last Updated" date above.

To report an issue or ask a question, email support@ctrlops.io.