Workflow Native Apps LTD ("the Company") values the security community and is committed to maintaining the security, integrity, and resilience of our web infrastructure and downloadable software applications. This Vulnerability Disclosure Policy (VDP) defines the rules for discovering and reporting vulnerabilities to us in good faith.
1. SCOPE OF POLICY
This policy applies exclusively to:
• Proprietary software binaries, source code packages, and desktop applications published directly under the official corporate authorship of Workflow Native Apps LTD.
• Web domains, serverless edge configurations, and network infrastructure owned, operated, or configured directly by the Company.
Out of Scope:
Any third-party native storefronts (such as the Microsoft Store, Apple App Store, and Snapcraft), independent Merchants of Record (MoR), or external web infrastructure routing nodes. Vulnerabilities found within those platforms must be reported directly to their respective corporate providers.
2. RESEARCH AND EXCLUSION RULES
When conducting security research, you must act in good faith and avoid causing operational harm. You are strictly prohibited from:
• Executing Distributed Denial of Service (DDoS) attacks, brute-force attacks, or resource exhaustion techniques against our web routing infrastructure.
• Utilizing automated vulnerability scanners in a destructive manner that disrupts network traffic or violates our strict Same-Origin Content Security Policies (CSP).
• Engaging in social engineering, phishing, or physical security attacks against Company personnel or contractors.
• Accessing, modifying, destroying, or manipulating data that does not belong to you, including inbound communication logs or technical email systems.
3. REPORTING A VULNERABILITY
If you discover a security flaw or configuration vulnerability within our scope, you must report it to us immediately.
• Submission Pathway: Send your detailed technical report via encrypted email to: [Insert Your Security/Support Email].
• Required Content: Your report should include a clear description of the vulnerability, the specific software version or target URL affected, detailed steps to reproduce the exploit (including proof-of-concept scripts or screenshots), and an assessment of the potential impact.
4. COUPLING WITH LEAN INFRASTRUCTURE & REVIEWS
Upon receipt of a valid disclosure, the Company will acknowledge your report within 5 business days and evaluate the technical findings. Because our web presentment utilizes automated edge routing and network threat detection, any verified infrastructure level flaws will be mitigated in partnership with our upstream network security providers. We do not offer an active monetary bug bounty program at this time, but we will validate your findings and provide professional attribution if requested.
5. STRICT MUTUAL NON-DISCLOSURE AND COORDINATION
To protect our user ecosystem, you must adhere to coordinated vulnerability disclosure protocols. You agree not to publicly disclose, leak, or share details of the vulnerability with any third party until the Company has formally validated, patched, and resolved the security issue.
6. LEGAL SAFE HARBOR
If you comply fully with the terms and exclusion rules outlined in this policy when researching and reporting a vulnerability, the Company considers your research to be authorized. We will not initiate civil litigation or request criminal investigations against you for activities conducted in accordance with this document.
7. CONTACT
For general technical support or operational queries, use our primary website channels. Use the dedicated security contact pathway defined in Section 3 exclusively for reporting active software and infrastructure vulnerabilities.