Security & Responsible Disclosure Policy

1. Reporting Security Vulnerabilities

If you believe you have discovered a potential security vulnerability in the CredSecure public website (getcredsecure.com), please report it to us privately:

Please do not send live credentials, production tokens, private keys, or unnecessary personal information in your initial report.

2. Good-Faith Research Rules

Researchers participating in vulnerability discovery must:

• Test only systems you are authorized to test;
• Minimise impact and avoid data destruction or service disruption;
• Stop testing immediately if customer credentials or sensitive data are unexpectedly exposed;
• Do not disrupt services, introduce persistence, extort, phish or pivot to unrelated systems; and
• Allow reasonable time for investigation before any public disclosure.

4. Encouraged Issues

We encourage responsible reports regarding:

• Authentication or authorization bypass;
• Privilege escalation;
• Unauthorized credential or secret exposure in public endpoints;
• Material API authorization weaknesses;
• Reproducible security vulnerabilities materially affecting confidentiality, integrity or availability.

5. Safe Harbor Intent

Innodhee supports good-faith security research conducted lawfully and in accordance with this policy. Where a researcher makes a genuine effort to comply with this policy, avoids harm, promptly reports the issue, and does not misuse information obtained during testing, Innodhee intends to treat the activity as responsible security research rather than malicious activity.