If you've found a security issue in Flareo's platform — or in a module we've published — we want to hear from you before anyone else does. This page documents the channel, our response timeline, and what you should expect.
Encrypt with our PGP key (below) if the report contains sensitive details. Plain email is fine for a heads-up; follow up with details over the encrypted channel.
4F3A 2C1B 9E7D 8C5A 6F2D 3B1A 7C9D 8E2F 4A6B 1C3DFull key at flareo.dev/.well-known/pgp-key.asc.
For active exploitation: if you believe a vulnerability is being actively exploited against Flareo or against deployed modules, mark the email subject [URGENT-EXPLOIT] — it pages on-call.
We will not pursue legal action against good-faith security researchers who:
If your testing activities raise concerns about authorization, contact us first. We'd rather talk through it than discover the testing in our logs without context.
Honest answer: we don't run a paid bounty program yet.
For high-impact reports we offer a public credit on the /incidents page, swag, and a thank-you that we mean. When Flareo has revenue to support a structured bounty, we'll publish the program in detail rather than running an informal one. Until then, we ask researchers to report for the same reason we'd report bugs we find ourselves: because fixing them makes the platform safer for everyone running it.