VULNERABILITY DISCLOSURE AND SECURITY REPORTING POLICY

Reporting channel

Send a concise initial report to info@relesona.com with the subject “Security report — tech.relesona.com”. Identify the affected URL or service, date and time, environment, reproducible steps, observed impact and a secure way to contact you.

Do not send exploit archives, credentials, secrets or unnecessary personal data in the first message. RELESONA may arrange a secure follow-up channel after triage.

Good-faith research

Use only systems, accounts and data that you own or are expressly authorised to test. Stop if you gain access to another person’s data, unintended persistent access or a condition that risks availability, confidentiality or integrity.

• Do not conduct denial-of-service, destructive or resource-exhaustion testing.
• Do not use phishing, social engineering, malware, credential attacks or physical intrusion.
• Do not perform broad automated scanning, persistence, privacy invasion or unnecessary data extraction.
• Do not publicly disclose an unresolved vulnerability before a reasonable coordination period.

Response and coordination

RELESONA will triage credible reports, may request clarification and will coordinate remediation and disclosure proportionately to risk. Statutory incident and vulnerability-reporting duties take priority where they apply.

This policy does not authorise unlawful activity. No public bounty, reward or guaranteed safe harbour is offered unless RELESONA expressly confirms it in writing for the specific report.

Recognition and privacy

RELESONA will not publicly identify a reporter without permission unless law requires disclosure. A reporter who seeks recognition should state the preferred name and disclosure timing.