Responsible disclosure
Found a flaw? Tell us without fear.
We take security reports seriously. Our policy sets a single channel, a 90-day publication window, and a commitment not to pursue good-faith researchers.
Our policy, in three commitments
Simple rules that apply to every good-faith report.
- One channel — security@ubidesk.io.
- 90-day coordination — we agree together on the publication timeline once the fix is in place.
- No legal action — against researchers who report in good faith.
How to report a vulnerability
Send your report to security@ubidesk.io with as much detail as you can.
- What to include — affected product and version, steps to reproduce, potential impact, and your disclosure deadline if you have one.
- Encryption — our public PGP key is available on request at security@ubidesk.io.
- Credit — researchers who report a vulnerability are credited publicly, with their consent.
After you report
Here is what you can expect from us.
- A quick response — we investigate any credible report promptly.
- A coordinated fix — we aim to ship a fix within 90 days, before any publication.
- Bounties, eventually — a bug bounty program is on our roadmap; it has not launched yet.
Contact sécurité
Security
FAQ
Frequently asked questions
How fast do you respond?
We investigate any credible report quickly. Publication coordination then runs on a timeline of up to 90 days.
Can I publish my finding myself?
We ask you to coordinate publication with us, within 90 days, so there is time to ship a fix.
Do you pay bounties?
Not yet. A bounty program is on our roadmap. Good-faith researchers are credited on our acknowledgments page.
How do I encrypt my report?
Our public PGP key is available on request. Until then, send your report in plain text to security@ubidesk.io.
Found a flaw? Tell us without fear.
We take security reports seriously. Our policy sets a single channel, a 90-day publication window, and a commitment not to pursue good-faith researchers.
No credit card · Free for personal use