Responsible disclosure

1. How to report

Email security@esorasign.com with steps to reproduce, the impact, and your contact details. Please encrypt sensitive details; our key is on the Security page.

2. Our promise

• We reply within 3 business days.
• We keep you updated until it is fixed.
• We will not take legal action against good-faith research that follows this policy.
• With your permission, we credit you on our thanks page.

3. Please

• Test only accounts you own.
• Do not access, change or delete other people's data. Stop and report as soon as you see any.
• Do not run denial-of-service, social engineering or physical tests.
• Give us reasonable time to fix before you publish.