Security and responsible disclosure

If you’ve found a security problem in something Inoku runs or publishes, we want to hear about it. This page says how to tell us and what we promise in return.

How to report a problem

Email security@inoku.com. Plain email is fine. If you prefer to encrypt, say so in a first message and we’ll arrange a key.

Please include:

• what you found and where (the URL, host or file);
• steps to reproduce it, as briefly as you can;
• what you think the impact is;
• how you’d like to be credited, or that you’d rather not be.

Don’t send us personal data that isn’t yours, and don’t go further than you need to in order to show that the problem is real. If you’ve reached data that isn’t yours, stop and tell us.

What we promise

• An acknowledgement within 3 working days. A human will read your report and reply.
• A first assessment within 10 working days. We’ll tell you whether we can reproduce the problem, how serious we think it is and what we plan to do.
• No legal action against good-faith research. If you follow this page, act in good faith and don’t harm people or data, we won’t pursue legal action and we won’t ask anyone else to.
• Credit if you want it. We’ll name you, with a link if you like, when we publish a fix. We can also keep you anonymous.
• Updates until it’s closed. We’ll tell you when a fix is live.

We don’t run a paid bounty programme. We’re a small lab and we’d rather say that plainly than make a promise we can’t keep.

Scope

Anything Inoku runs or publishes: this website, its forms, its DNS and mail, anything under inoku.com, and any code or data we publish under our name.

Out of scope: services run by third parties that we only link to, denial-of-service testing, social engineering of people who work with us, and findings that need physical access to hardware.

Our security.txt

The machine-readable version of this page is at /.well-known/security.txt. It follows RFC 9116 and lists the contact address, an expiry date, the preferred language and its canonical URL. If the file and this page ever disagree, tell us; the file is the one tools read, so we’ll fix it first.

Safe harbour, in plain words

We consider research done under this policy to be authorised. If a third party questions work that followed this page, we’ll confirm that it did. This isn’t a licence to act outside the rules above.