Responsible Disclosure
We welcome good-faith security research that helps keep Neurako learners and their study data safe.
01. How To Report
Email reports to [email protected] with the subject prefix [SECURITY].
If you send proof-of-concept requests to our systems, include the HTTP header X-Neurako-Security-Research: [email protected] so we can distinguish testing from abuse in logs.
Include the affected URL or API endpoint, steps to reproduce, impact, screenshots or request/response snippets when useful, and whether you want public credit.
02. In Scope
- Neurako web app: app.neurako.com
- Neurako marketing site: neurako.com and www.neurako.com
- Neurako iOS and Android applications
- Neurako-owned API endpoints used by the apps
- Access-control, authentication, payment-accounting, storage, and user-data issues
03. Out of Scope
- Denial-of-service, spam, phishing, or social-engineering tests
- Physical attacks, employee targeting, or attempts to access employee accounts
- Automated scanner output without a reproducible security impact
- Reports for third-party services unless they directly affect Neurako users
- Issues requiring compromised devices, rooted devices, or user-installed malware
04. Research Rules
Use your own accounts and test data. Do not access, modify, delete, or exfiltrate data that does not belong to you. Stop testing and report immediately if you encounter another user's data.
Keep testing low volume, avoid persistence, and do not publicly disclose a vulnerability before we have had a reasonable opportunity to fix it.
05. Recognition, Not Rewards
We do not currently operate a bug bounty program and cannot offer monetary rewards, swag, or other compensation for reports.
For valid, helpful reports, we can offer public credit in a Hall of Fame entry or security blog article if you want to be named.
06. Response Timeline
We aim to acknowledge security reports within 48 hours.
We aim to provide an initial triage decision within 5 business days and will share material remediation updates when a report is valid and actionable.