Responsible disclosure
Reporting security vulnerabilities to Clatter Labs.
- Can I run a security scanner against Clatter Labs?Not without authorisation. Unauthorised scanning or probing is prohibited. Ask for written permission first.FAQ
- Does Clatter Labs have a bug bounty?No public bug bounty programme or reward amounts are published. Report issues through the Support Center.FAQ
- How do I report a security vulnerability?Report it through the Support Center marked as a security report. Keep it confidential, and avoid harm to users and data.How-to
- I found someone's Clatter Labs API key online. What should I do?Don't use it. Report where you found it through the Support Center so it can be disabled and the owner told.How-to
- What are the rules for security research on Clatter Labs?Only under the responsible-disclosure policy or with written permission, avoiding harm, and reported promptly and confidentially.Policy
- What happens after I report a vulnerability?Support confirms receipt and the team investigates. We usually reply within the first hour and always within 24 hours.FAQ
- What should I include in a vulnerability report?The affected product and URL, steps to reproduce, impact, what you accessed, and how to contact you.Reference
- What shouldn't I do while testing for vulnerabilities?Don't access or change others' data, don't disrupt service, don't use denial-of-service, and don't disclose publicly before a fix.Policy
Still need help?
Tried the steps above and still stuck? Email us. We usually reply within the first hour, and always within 24 hours. A full support team is with you.
Infrastructure questions, or permanent deletion of your data
infrastructure@clatterlabs.xyzFor deleting your whole account or the data of one service.