Divulgação Responsável
Aceitamos pesquisas de segurança feitas de boa fé que ajudem a manter os estudantes da Neurako e seus dados de estudo seguros.
01. Como reportar
Email reports to [email protected] with the subject prefix [SECURITY].
If you send proof-of-concept requests to our systems, include the HTTP header X-Neurako-Security-Research: [email protected] so we can distinguish testing from abuse in logs.
Include the affected URL or API endpoint, steps to reproduce, impact, screenshots or request/response snippets when useful, and whether you want public credit.
02. No escopo
- Neurako web app: app.neurako.com
- Neurako marketing site: neurako.com and www.neurako.com
- Neurako iOS and Android applications
- Neurako-owned API endpoints used by the apps
- Access-control, authentication, payment-accounting, storage, and user-data issues
03. Fora de escopo
- Denial-of-service, spam, phishing, or social-engineering tests
- Physical attacks, employee targeting, or attempts to access employee accounts
- Automated scanner output without a reproducible security impact
- Reports for third-party services unless they directly affect Neurako users
- Issues requiring compromised devices, rooted devices, or user-installed malware
04. Regras de pesquisa
Use your own accounts and test data. Do not access, modify, delete, or exfiltrate data that does not belong to you. Stop testing and report immediately if you encounter another user's data.
Keep testing low volume, avoid persistence, and do not publicly disclose a vulnerability before we have had a reasonable opportunity to fix it.
05. Reconhecimento, não recompensas
We do not currently operate a bug bounty program and cannot offer monetary rewards, swag, or other compensation for reports.
For valid, helpful reports, we can offer public credit in a Hall of Fame entry or security blog article if you want to be named.
06. Prazo de resposta
We aim to acknowledge security reports within 48 hours.
We aim to provide an initial triage decision within 5 business days and will share material remediation updates when a report is valid and actionable.