Vulnerability disclosure policy
DayBreach is a security product and takes its own security seriously. If you have found a vulnerability, thank you for reporting it in good faith. This page explains how to report it and what we commit to in return.
How to report
Write to security@daybreach.dev or use the contact form . A short note on where the issue is, how to reproduce it and its likely impact is enough.
Our commitments
- We answer your report within 5 working days and keep you informed while we fix it.
- We will not take legal action over good-faith research that follows this policy.
- If you wish, we thank you by name once the fix is out. DayBreach is a free product, so we do not pay bounties.
In scope
- daybreach.dev and its subdomains
- api.daybreach.dev
- The organisation panel and the Intelligence API
- The DayBreach mobile app
Out of scope
- Tests that slow down or stop the service (DoS, load testing)
- Social engineering and phishing aimed at users or staff
- Accessing, changing or deleting other users' data
- Vulnerabilities in third-party sources whose data we use (report those to the source)
- Findings that cannot be exploited, such as a version string or a missing header on its own