Responsible Disclosure Policy

Email security@imaraautomata.dev with a description of the issue, the affected URL or endpoint, reproduction steps, and the impact you believe it has. A machine-readable copy of this contact information is published at /.well-known/security.txt. Please do not open public issues or post details publicly before we have responded.

• Acknowledgement within 3 business days.
• An initial assessment, including severity, within 10 business days.
• Remediation targets from triage: critical within 7 days, error-severity within 30 days, warning within 90 days, informational at our discretion.
• Progress updates at least every 14 days until resolution.
• Credit in our disclosure acknowledgements if you would like it.

If you make a good-faith effort to comply with this policy, we will treat your research as authorised, will not initiate or support legal action against you, and will work with you if a third party does. If you are unsure whether an action is in scope, ask first.

• The ImaraAutomata web application and its server functions and public API routes.
• Sign-in, roles, workspace isolation, recording share links, upload screening and approval steps.
• Data exposure between accounts or workspaces, and the Jira connection.

• Denial of service, volumetric testing, automated scanner noise without a demonstrated impact.
• Social engineering of our staff, customers or teammates; physical attacks.
• Reports that require a compromised device, a rooted browser, or self-inflicted configuration.
• Missing hardening headers with no demonstrated exploit path.
• Findings in third-party services we do not control, such as Atlassian Jira, which should go to that vendor.

• Use only accounts you own, or test accounts we provide on request.
• Never access, modify, exfiltrate or retain another customer's data. Stop as soon as you can demonstrate the issue, and tell us what you accessed.
• Do not degrade the service for other users.

We triage using the same shared vocabulary the product itself uses, so reports, audit events and internal alerts can be reconciled: severity is one of info, warning, error, critical and status is one of open, triaged, in_progress, resolved, wont_fix. Every report is assigned a request ID that both sides can quote.

Where an incident involves personal data, we notify the relevant supervisory authority — in Kenya, the Office of the Data Protection Commissioner — within the statutory timeframe, and affected users in-app.