Found a security issue? Tell us.

Susanoo does not operate a bug bounty program. We do not offer money, gift cards, or swag in exchange for vulnerability reports, and we will not negotiate a payment before reviewing a finding.

What we do offer is a real response and public credit. If you report a valid issue and you want to be named, we will credit you once it is fixed.

We will not review reports that are withheld pending payment, or that arrive with a request to agree to terms before the details are shared.

A report we can act on contains all of the following:

• The affected URL, endpoint, or component
• Clear steps to reproduce the issue
• The impact you observed, not the impact a scanner predicted
• The date and time you tested, so we can match it against our logs

Reports that are raw scanner output with no demonstrated impact will be closed without a detailed response. A tool flagging something is not the same as an exploitable issue.

• susanoo.ai and its subdomains
• The serverless functions that power our forms and gated content
• Our client administration application

Third-party platforms we use are not ours to fix. If the issue is in a vendor's product, please report it to that vendor. Tell us anyway if it exposes our data or our clients' data, and we will follow up with them.

We will not action the following without a working exploit that shows real impact:

• Missing or misconfigured security headers, including CSP, HSTS, X-Frame-Options, and Referrer-Policy
• SPF, DKIM, or DMARC policy configuration
• Clickjacking on pages with no sensitive state-changing action
• Missing rate limiting on public forms
• Self-XSS, or attacks that require a compromised device or physical access
• Denial of service, volumetric testing, or load testing of any kind
• Social engineering of our staff, our clients, or our vendors
• Software version disclosure, banner grabbing, or directory listings with no sensitive content
• Cookie flags on cookies that carry no authentication value
• Best-practice recommendations with no demonstrated exploit path

While researching, you must:

• Test only against accounts and data you own or have permission to use
• Stop as soon as you confirm a vulnerability, and never go further into a system than needed to demonstrate it
• Never access, modify, download, or retain data belonging to Susanoo, our clients, or their customers
• Never degrade, interrupt, or damage our services
• Give us reasonable time to fix the issue before disclosing it publicly

If you follow the rules above and report in good faith, we will not pursue legal action against you for your research, and we will not report you to law enforcement.

We consider work done under this policy to be authorized access. If a third party brings legal action against you for research that stayed within this policy, we will make that authorization clear.

This protection ends the moment research moves outside the rules above, in particular if you access or retain data that is not yours, or if you attempt to extract payment in exchange for withholding a finding.

We aim to acknowledge every report within five business days. We are a small team, so that is a realistic commitment rather than an optimistic one.

We will tell you whether we consider the issue valid and in scope. We will not commit to a fix date up front, but we will let you know when it is resolved, and we will credit you publicly at that point if you want to be named.