If you've found a security issue in Flareo's platform — or in a module we've published — we want to hear from you before anyone else does. This page documents the channel, our response timeline, and what you should expect.
File a private advisory against the Flareo repository. Reports stay confidential until coordinated disclosure. Include steps to reproduce, affected components, and impact when you can.
For active exploitation: if you believe a vulnerability is being actively exploited against Flareo or against deployed modules, mark the advisory title with [URGENT-EXPLOIT] — it pages on-call.
We will not pursue legal action against good-faith security researchers who:
If your testing activities raise concerns about authorization, contact us first via GitHub Security Advisories. We'd rather talk through it than discover the testing in our logs without context.
Honest answer: we don't run a paid bounty program yet.
For high-impact reports we offer a public credit on the /incidents page, swag, and a thank-you that we mean. When Flareo has revenue to support a structured bounty, we'll publish the program in detail rather than running an informal one. Until then, we ask researchers to report for the same reason we'd report bugs we find ourselves: because fixing them makes the platform safer for everyone running it.