Vulnerability Disclosure Policy

DREKAR CRM LLC welcomes reports from security researchers acting in good faith. This policy explains what DREKAR CRM LLC considers in-scope, what researchers may and may not do while testing, how to report findings, and how DREKAR CRM LLC will respond.

The following are in scope:

• the DREKAR CRM production web application and its public APIs
• authenticated flows accessed through a researcher's own test account
• public marketing pages and forms operated by DREKAR CRM LLC

The following are out of scope and researchers must not test against them:

• systems operated by third-party subprocessors (Stripe, Google, Cloudflare, Supabase, and others listed on the Subprocessor List)
• Customer-owned accounts, data, or content unless the researcher owns the affected Customer account
• physical facilities, social engineering, and vishing against DREKAR CRM LLC personnel
• denial-of-service, resource-exhaustion, and stress testing
• reports based solely on missing best-practice headers or theoretical issues without a demonstrable impact
• findings that require compromising a Customer account the researcher does not control

Researchers agree to:

• test only against their own accounts and data
• stop testing and report immediately on encountering another party's data
• avoid destructive actions and privacy violations
• avoid degrading service availability
• use minimum necessary proof-of-concept payloads
• give DREKAR CRM LLC a reasonable opportunity to remediate before public disclosure

DREKAR CRM LLC will not pursue legal action against researchers who make a good-faith effort to comply with this policy, whose testing is limited to the in-scope systems, and who avoid privacy violations and service disruption. If a third party initiates legal action against a researcher who has complied with this policy, DREKAR CRM LLC will make its position known that the activity was authorized.

Note for legal counsel: safe-harbor language should be reviewed against the Computer Fraud and Abuse Act, similar state laws, and any applicable non-U.S. legislation (including the EU Cyber Resilience Act) before public reliance.

Send reports to the DREKAR contact page (or the DREKAR contact page if the security address is not yet monitored). Include:

• a clear description of the issue and the affected component
• reproduction steps
• impact assessment
• any relevant logs, screenshots, or minimal proof-of-concept code
• contact information for follow-up

DREKAR CRM LLC will:

• acknowledge receipt within a reasonable time
• triage the report and communicate expected remediation timelines
• coordinate on public disclosure timing where appropriate
• close out the report when remediation is complete

With the researcher's permission, DREKAR CRM LLC may publicly acknowledge contributors who report valid, in-scope findings. DREKAR CRM LLC does not currently operate a paid bug bounty and any acknowledgement is discretionary.