Security at Koomalooma

We take the security of our platform and our customers' data seriously. If you believe you have found a security vulnerability in Koomalooma, we want to hear from you. This page explains how to report it and what you can expect from us.

Reporting a vulnerability

Email your report to support@koomalooma.com. Please include:

  • The affected URL, endpoint or feature.
  • Steps to reproduce the issue, with any relevant payloads.
  • The impact you believe the issue has.
  • A way to reach you for follow-up questions, if different from the sending address.

We aim to acknowledge every report within 5 business days. We will keep you informed while we investigate and let you know when the issue is resolved.

Our commitment to researchers

We will not pursue legal action against researchers who act in good faith and within this policy. Acting in good faith means:

  • You only access, modify or delete data that belongs to you or to test accounts you created.
  • You do not degrade or disrupt the service for other users.
  • You give us a reasonable amount of time to fix the issue before disclosing it publicly.
  • You do not use a vulnerability beyond what is needed to demonstrate it.

Out of scope

The following are not in scope for reports:

  • Denial-of-service or other volumetric attacks.
  • Social engineering or phishing of our staff, suppliers or customers.
  • Physical attacks against our offices or infrastructure.
  • Reports from automated scanners without a demonstrated, exploitable impact.
  • Missing security headers or email authentication records (SPF, DKIM, DMARC) without a working proof of concept.
  • Vulnerabilities in third-party services we use but do not operate. Please report those to the service in question.

Rewards

We do not currently run a paid bug bounty program. We are happy to credit you for a valid report if you would like us to.

How we handle payment data

Card payments on Koomalooma are processed by our payment service provider on their own hosted payment pages. Card numbers are entered with the provider and never touch our servers.

Machine-readable policy

This policy is referenced from www.koomalooma.com/.well-known/security.txt, following RFC 9116.