Report a vulnerability.

Email security@startiqosai.com. If that address ever bounces, use info@startiqosai.com. Please include:

• the page, address or component affected;
• what the weakness is and what an attacker could do with it;
• the steps to reproduce it, with any proof-of-concept code or screenshots;
• how you would like to be credited, or that you prefer not to be.

Do not put personal data you came across, or live credentials, in the first email. Tell us it exists and we will agree a secure way to receive it. Our contact details are also published in machine-readable form at /.well-known/security.txt.

• This website: startiqosai.com and www.startiqosai.com, including its forms, assistant and headers.
• Our software: the StartiQOS gateway and console, in a pilot or test installation you are authorised to use.
• Other startiqosai.com addresses that we operate.

• Services run by others, such as Cloudflare, Google Fonts, GitHub, LinkedIn, Instagram and WhatsApp. Report those to their owners.
• Any system belonging to our customers or pilot partners, unless they have given you written permission.
• Denial-of-service, load testing or high-volume automated scanning.
• Social engineering, phishing, or physical access to people or offices.
• Reports with no security impact, such as missing headers on pages without sensitive content, version disclosure on its own, or clickjacking on pages with no actions.

• Use only accounts and data that are yours, or test data. Do not access, change or delete other people’s data.
• If you reach personal data, credentials or confidential information, stop, keep no copy beyond what the report needs, and tell us straight away.
• Do only what is needed to show the weakness exists. Do not use it to move further into our systems.
• Keep automated requests slow. Do not send more than a few requests per second, and never submit our forms in bulk.
• Give us time to fix the problem before telling anyone else about it (see below).
• Do not demand payment in exchange for not disclosing a weakness.

We will tell you when the fix is live and, if you wish, credit you by name or handle when we describe the fix.

If you act in good faith and follow this policy, we will treat your research as authorised. We will not take legal action against you, or report you to law enforcement, for that research. If someone else takes legal action against you for research that followed this policy, we will make it known that your work was authorised by us.

If you accidentally go beyond this policy and tell us promptly, we will treat that as good faith. If you are unsure whether something is allowed, ask us at security@startiqosai.com before you do it.

We can only authorise testing of systems we own. This policy cannot give permission to test services run by others, which have their own rules.

Please wait until we have fixed the weakness, or 90 days have passed since your report, before you publish details. If a fix needs longer, we will explain why and agree a date with you. If a weakness is being actively exploited, we may ask to publish sooner together, so that people can protect themselves.

We do not run a paid bug bounty at present. We are a small team, and we will thank you publicly if you want us to.