Vulnerability Disclosure Policy
Where to report a flaw in Katching, what is in scope and what is not, how fast we answer, and what we promise to whoever takes the time to report one.
How to report
Write to security at our domain, in English or in French. Tell us what you found, where, and how to reproduce it. A screenshot or a short recording helps.
You will get an acknowledgement within five business days, and we will tell you what we intend to do about it.
Scope
In scope: the Katching site and its subdomains, the administration of a store, the storefronts served by Katching, and the public interfaces of the platform.
Out of scope: the services of our providers, which have their own programs; a store's own third party integrations; reports produced only by an automated scanner with no demonstrated impact; and findings that need physical access to a device.
The rules
- Do not access, modify or keep data that is not yours. If you reach data of a merchant or of a customer, stop, and tell us what you reached.
- Do not degrade the service: no denial of service, no load testing, no mass automated traffic.
- No social engineering, no phishing of our team or of a merchant, no physical intrusion.
- Use only your own accounts and your own test store.
- Give us a reasonable time to fix the issue before you tell anyone else about it.
Safe harbor
Research done in good faith and within these rules is authorized. Katching will not pursue you for it, and will not ask a provider to, as long as you stayed within the rules above and told us what you found.
This safe harbor is ours to give. It does not bind a third party whose service you also touched.
Rewards
Katching runs no bug bounty and announces no monetary reward. We answer, we fix, and we credit you by name if you want to be credited.