Quoridea Vulnerability Disclosure Policy

Draft for review. This document may change before paid plans open.

Version 0.1, 2026-10-28. Provider: Mitikasha LLC ("Quoridea"). Contact: security@quoridea.com.

We welcome reports of security vulnerabilities in Quoridea from anyone. This policy says how to report one and what you can expect from us.

How to report

Email security@quoridea.com with a description of the issue, the steps to reproduce it, and its impact as you understand it. Please do not include other people's personal data.

Scope

In scope: quoridea.com and its subdomains, including the public demo at demo.quoridea.com.

Out of scope: denial of service and load testing; social engineering or phishing of our staff or customers; physical attacks; reports from automated scanners without a demonstrated impact; missing best-practice headers without an exploit; issues in Cloudflare's own platform (report those to Cloudflare).

Rules for testing

Use only accounts and organizations you created yourself. The demo company is shared (and rebuilt every night): do not change its data in ways that would disrupt others.
Never access, change or delete data of another organization. If you reach any, stop, and tell us what you saw.
Do not degrade the service, and do not keep or share any data you obtain.
Give us reasonable time to fix the issue before you disclose it publicly.

What we commit to

To acknowledge your report within 3 business days, and to keep you informed until it is fixed.
To aim to fix critical issues within 7 days and high-severity issues within 30 days. (to be confirmed)
Not to pursue legal action against good-faith research that follows this policy.
To credit you, if you wish, once the issue is fixed.

We do not run a paid bug bounty.