---
title: "Responsible disclosure"
url: "https://unshade.pl/en/responsible-disclosure"
lang: "en"
---

# Responsible disclosure

Found a vulnerability in our systems? Report it to us — we will respond, fix it and say thank you.

We take security seriously — our own included. If you have found a vulnerability in our systems or services, let us know. We will respond, fix it, and take no legal action against anyone acting in good faith and within the rules below.

## How to report a vulnerability

- Email [contact@unshade.pl](mailto:contact@unshade.pl). If the report contains sensitive details, ask for a secure channel in your first message and we will set one up.
- Describe the vulnerability, its impact and the steps to reproduce it. Screenshots, HTTP requests or a short PoC help a lot.
- You may report anonymously. If you share contact details, we use them only to discuss the report.

## What we promise

- We confirm receipt of your report and keep you informed about progress.
- We stay in touch during analysis and remediation and tell you the outcome once the issue is closed.
- With your consent, we thank you publicly for the report.
- We take no legal action against researchers who act in good faith and follow these rules.

## Rules

- Do not violate anyone's privacy, destroy or modify data, or degrade the availability of services (no DoS attacks).
- Do not use social engineering against our employees, clients or partners, and do not access other people's accounts.
- Test only with your own accounts and data. If you come across personal or confidential data, stop and report it.
- Do not disclose the vulnerability publicly before it is fixed and we have agreed on a publication date.

## Scope

Reports cover the unshade.pl domain, its subdomains and the systems we operate. Third-party services we use are out of scope — report those directly to their providers. Vulnerabilities in our clients' systems are handled under the terms of the respective engagements.