SecaResponsible disclosure
Found a Secatix issue? Tell us at security@secatix.com. We acknowledge in 48 hours. No bounty yet — honest for a startup — but full credit if you want it.
How to report
- Email security@secatix.com with steps, URLs, impact. PGP on request.
- Do not access client data, destroy data, DoS, or mass-brute-force.
- Minimize access, stop at proof, tell us promptly.
Safe harbor
Good-faith research within this policy is authorized. We will not pursue legal action for accidental, non-destructive findings reported promptly.
What we protect
Engagement materials: encrypted storage, need-to-know sharing, 90-day deletion if no engagement (see Privacy), retention per agreement + insurance if engaged. Rules: Terms & RoE.
Contact
Security: security@secatix.com (forwards to hello@). General: hello@secatix.com.
Need an engagement scoped?
Talk to a tester about authorization boundaries.