Reporting a security issue

If you believe you have found a security issue in Mamentis, write to security@mamentis.com. Tell us what you found, where, the steps to reproduce it, and everything you accessed while confirming it. We acknowledge reports within two business days.

Rules for testing

• Stop at the minimum needed to prove the issue. Do not download, keep or share data beyond that proof.
• Do not sign in with credentials you find or guess, do not change or delete anything, and do not create accounts or resources on our systems.
• Do not access, or try to access, another person's data.
• Do not run tests that degrade service for others: no load testing, denial of service or spam.
• Give us reasonable time to fix the issue, and agree any publication with us first.

Good-faith testing

If you test in good faith and within these rules, we consider your testing authorised. We will not pursue legal action against you or treat it as a breach of our terms, and we will work with you to understand and fix the issue. Testing outside these rules is not covered.

Recognition

Mamentis is pre-launch and does not pay cash rewards. We thank valid reports with free Mamentis membership, starting when Mamentis becomes generally available:

• Low: 3 months
• Medium: 6 months
• High and Critical: 12 months

The first report of an issue receives the full recognition; later reports of the same issue may receive less. Exceptionally valuable reports may receive more. Reports that go beyond the rules above may not qualify.