Security disclosure policy

Report an issue

Email sami@deepguards.com with the affected area, a minimal reproduction, expected impact, and a safe way to contact you. Please do not send credentials, private keys, access tokens, client data, or evidence unless we have agreed a secure transfer method.

Good-faith testing

• Use only accounts, tenants, and test data you control.
• Stop after proving the issue; do not persist, exfiltrate, alter, or delete data.
• Do not test client environments, third-party systems, availability, or people.
• Give DeepGuards reasonable time to investigate before public disclosure.

What happens next

We acknowledge and assess reports, prioritise issues involving tenant isolation, authentication, sessions, credentials, and evidence, and keep reporters informed when contact details are provided. DeepGuards does not offer a bounty program.