Vulnerability disclosure
Authorized good-faith security research against Endia-controlled systems.
In scope: publicly reachable Endia application hosts you reasonably believe are operated by Endia (for example production and preview deployments under Endia control), and issues in Endia product code that affect customer data, auth, billing, or tenant isolation.
Out of scope: third-party provider platforms themselves (Vercel, GitHub, Stripe, email providers), social engineering, physical attacks, denial-of-service that disrupts availability, and testing of other customers' accounts or data.
- Do not access, modify, or destroy data that is not yours.
- Do not perform destructive testing, ransomware simulation, or mass scanning.
- Do not publicly disclose an issue before we have had a reasonable chance to respond.
- We do not currently operate a paid bug bounty.
Email security@endia.dev. Include steps to reproduce, affected URL or endpoint, and impact.
We aim to acknowledge actionable reports within a few business days when capacity allows. We do not publish a fixed contractual response window on this page.