We are a security audit platform. Our security keeps us awake. If you have discovered a vulnerability in CAI-Deceneu, report it to us safely — acknowledgement within a maximum of 72h, safe harbor for good-faith research, and a public mention in the Hall of Fame (with your consent).
Send your report to support@scanope.com, encrypted with the PGP key above for sensitive details (PoC, exploit chain, credentials found).
We respond within a maximum of 72h with a confirmation of receipt + tracking ID. We triage and inform you of the severity within a maximum of 7 business days.
We work with you on a reasonable timeline (90 days as standard). You propose, we negotiate. Public disclosure ONLY after patch + mutual agreement.
With your consent, we list you publicly in the Hall of Fame under the name/handle of your choice. Financial bug bounty — not active at the moment.
scanope.com + all subdomains/api/v1/*)/bos/*) — ONLY vulnerabilities identified without unauthorized authentication/m/*)Until 2031-09-30, the Gateway component of CAI-Deceneu receives security updates (Regulation (EU) 2024/2847 (Cyber Resilience Act), Annex II point 7).
CAI-Deceneu adheres to the disclose.io Safe Harbor principles. For research carried out in good faith within the limits of the scope, we will NOT initiate legal action.