Responsible Disclosure Policy

This policy covers https://drentova.com and any service operated by Drentova Group W.L.L. It does not cover third-party services we use — report those to their owners.

• Report to [email protected] before disclosing anywhere else, and give us reasonable time to fix it.
• Give us enough detail to reproduce the issue.
• Do not access, modify or delete data that is not yours, and stop as soon as you have confirmed a vulnerability exists.
• Do not degrade the service — no denial of service, no automated scanning that generates significant load, no social engineering of our staff or customers.

• We acknowledge within 3 working days and tell you our assessment within 10.
• We keep you updated until it is resolved, and tell you when it is.
• We will not pursue or support legal action against anyone acting in good faith under this policy.
• We will credit you publicly if you would like us to.

We do not currently run a paid bug bounty. We will say so here if that changes rather than leaving it ambiguous.