Reporting a vulnerability
Last updated:
How to report
If you think you have found a vulnerability on bimon.it, write to security@bimon.it. Please include:
- the address of the page or API involved
- the steps to reproduce the issue
- what an attacker could achieve
- if you would like to be credited, the name to use
You can write in English or Italian. Do not send us other people's personal data: if you came across any while testing, describe it without copying it.
Scope
In scope: the bimon.it website, its APIs (/api/…) and the bimon.it subdomains operated by BIMON.
Out of scope:
- third-party services we use (Microsoft 365, Vercel, Resend, PostHog, LinkedIn, Dealfront): please report to them directly
- denial-of-service attacks, high-volume requests or bulk email
- phishing, social engineering and physical access to our offices
- automated scanner output without a demonstrated impact
While testing
- use only your own accounts and data
- do not modify, delete or download data that is not yours
- do not submit contact forms or newsletter sign-ups on behalf of other people
- stop as soon as you have proof of the issue
- do not make the vulnerability public before we have fixed it or agreed a date with you
What we do
We confirm that we have received your report, check the issue and keep you updated until it is fixed. If you wish, once it is fixed we credit you as the reporter.
We do not run a paid bug bounty programme.
Good faith
If you act in good faith and follow the guidance on this page, we consider your activity authorised research and will not take legal action against you.