Vulnerability disclosure policy

Report suspected vulnerabilities privately to security@regengine.co. Do not include credentials, customer data, or unnecessary personal data in the initial report.

What to include

• The affected URL, API operation, or deployed version.
• Reproduction steps using disposable accounts and synthetic data.
• The observed impact and any safe proof material.
• A secure contact method for follow-up.

Research boundaries

Use only accounts and tenants you control. Do not access, modify, retain, or disclose another party's data; degrade availability; send unsolicited messages; evade platform mitigations; or test third-party services. Stop and report immediately if you encounter non-synthetic data.

Our process

We will acknowledge receipt when the security inbox is monitored, validate scope and impact, and coordinate remediation and disclosure based on the specific report. Response times are targets, not contractual service levels. RegEngine does not currently operate a public bounty.