Reporting a vulnerability.

Email security@cahaves.com. Include what you found, the steps to reproduce it, and what an attacker could do with it. A proof of concept helps more than a scanner output.

We acknowledge the report before we have a fix, so you are not left wondering whether it arrived. We tell you what we assess the severity to be and why. We tell you when it is fixed, and we credit you if you want to be credited.

Give us a reasonable window to fix the issue before disclosing it publicly. Do not access, modify or delete data belonging to anyone else while testing. Do not run denial-of-service tests or automated scans that degrade the service for other people.

This site, the three product services, and any subdomain of cahaves.com. Reports about third-party services we merely use should go to that third party.

There is no paid bounty at present. Saying so plainly is better than leaving it ambiguous and disappointing you after the work.