Responsible disclosure
How to report a security vulnerability in Kadolia and what you can expect from us when you do.
Last updated: September 29, 2026
Scope
This policy covers the public Kadolia website, the account and checkout surfaces, the admin control plane, the public APIs and the mobile preview surfaces we operate. A weakness you find in a third-party service should be reported to that service under its own policy.
How to report
Use the support form and choose Security report. That topic routes to the security team's controlled internal queue. Please do not open a public issue, post details publicly or test against other customers' data before we have investigated. Do not include credentials, secrets or personal data beyond what is needed to explain the issue. The form accepts text up to 4000 characters and no attachments, so keep the report concise and include a short reproduction.
What to include
Include the affected page or endpoint, the steps to reproduce, the impact you observed and a proof of concept that does not damage the service or expose other people's data. Good-faith testing stays within your own accounts and data.
Our commitments
We review every credible report, aim to acknowledge it promptly, investigate and remediate valid issues, and coordinate a reasonable public disclosure timeline with the reporter. We do not pursue legal action against researchers who act in good faith under this policy and applicable law. We do not operate a paid bug-bounty program.
Out of scope
Reports that require physical access, social engineering of staff, denial-of-service or load tests, spam, automated scanning that degrades the service, or issues that are already public are out of scope for this policy.
Handling your report
We keep reports confidential within the security team and share them only as needed to investigate and fix the issue. If you would like credit for a valid report, tell us the name you want us to use.
Legal operator
CUBE Collective LLC30 N Gould St. Ste. R, Sheridan, WY 82801, USA
For support, sales, privacy or legal requests, use the contact form. For formal notices, also use the matching obfuscated contact below.
- Security reports
- security [at] kadolia [dot] com