Responsible disclosure
Found a vulnerability in our systems? Report it to us — we will respond, fix it and say thank you.
We take security seriously — our own included. If you have found a vulnerability in our systems or services, let us know. We will respond, fix it, and take no legal action against anyone acting in good faith and within the rules below.
How to report a vulnerability
- Email contact@unshade.pl. If the report contains sensitive details, ask for a secure channel in your first message and we will set one up.
- Describe the vulnerability, its impact and the steps to reproduce it. Screenshots, HTTP requests or a short PoC help a lot.
- You may report anonymously. If you share contact details, we use them only to discuss the report.
What we promise
- We confirm receipt of your report and keep you informed about progress.
- We stay in touch during analysis and remediation and tell you the outcome once the issue is closed.
- With your consent, we thank you publicly for the report.
- We take no legal action against researchers who act in good faith and follow these rules.
Rules
- Do not violate anyone's privacy, destroy or modify data, or degrade the availability of services (no DoS attacks).
- Do not use social engineering against our employees, clients or partners, and do not access other people's accounts.
- Test only with your own accounts and data. If you come across personal or confidential data, stop and report it.
- Do not disclose the vulnerability publicly before it is fixed and we have agreed on a publication date.
Scope
Reports cover the unshade.pl domain, its subdomains and the systems we operate. Third-party services we use are out of scope — report those directly to their providers. Vulnerabilities in our clients' systems are handled under the terms of the respective engagements.