Security
At iKelp, we take the security of our services, infrastructure, and customer data seriously. If you believe you have discovered a security vulnerability in any iKelp service, product, website, or related infrastructure, please report it to us responsibly.
How to report a vulnerability
Please send security reports to:
security(at)ikelp.com
To help us investigate efficiently, please include as much of the following as possible:
- affected domain, application, or service,
- detailed description of the issue,
- steps to reproduce,
- proof of concept, screenshots, or logs,
- estimated impact,
- your contact details for follow-up questions.
Our approach
For legitimate security reports, we aim to:
- acknowledge receipt of the report,
- review and validate the finding,
- prioritize remediation based on severity and impact,
- maintain reasonable communication during the process.
Scope
This policy applies to services operated by iKelp, including public websites, customer-facing SaaS services, APIs, and supporting infrastructure managed by iKelp.
This may include, for example:
*.ikelp.com*.ikelp.cloud- other public services clearly operated by iKelp.
If you are unsure whether a system belongs to iKelp, include it in your report and we will review it.
Out of scope
The following are generally considered out of scope unless they show real security impact:
- spam or email best-practice issues without real exploitability,
- missing security headers without a practical attack scenario,
- clickjacking on pages with no sensitive actions,
- denial of service, stress testing, or resource exhaustion testing,
- social engineering, phishing, pretexting, or physical attacks,
- attacks against third-party systems not operated by iKelp,
- reports based only on outdated software versions without demonstrated impact,
- self-XSS or issues requiring unrealistic user interaction,
- automated scanner output without analysis and reproduction steps.
Rules of engagement
Please:
- act in good faith,
- avoid privacy violations and service disruption,
- test only to the extent necessary to confirm the issue,
- avoid accessing data that does not belong to you,
- do not modify or delete third-party data,
- stop testing once the issue has been confirmed,
- report the issue promptly.
Please do not:
- exploit a vulnerability beyond what is necessary for proof,
- create persistent access or backdoors,
- perform destructive testing,
- publicly disclose the issue before it has been reviewed and remediated.
Safe harbor
If you act in good faith, follow this policy, avoid privacy violations and service disruption, and give us reasonable time to investigate and remediate the issue, iKelp will not consider your research to be unauthorized under this policy.
This safe harbor applies only to activities consistent with this policy and does not extend to actions that violate law, regulation, or third-party rights.
Bug bounty
iKelp does not currently operate a public bug bounty program unless explicitly stated otherwise.
Contact
Security reports: security(at)ikelp.com
Reports may be submitted in Slovak or English.