In short
- Email [email protected] with the subject “Security report”.
- You get a first answer within 7 days.
- Please give us time to fix the issue before you publish it.
- There is no paid bug bounty.
1
What is in scope
- carchalabs.com
- visualizer.carchalabs.com, licensekit.carchalabs.com and monitoring.carchalabs.com
- The npm packages published under @carchalabs
2
How to report
Email [email protected]. Include what you found, where, the steps to reproduce it and what an attacker could do with it. A short report is fine.
The same contact is published in /.well-known/security.txt as described in RFC 9116.
3
Please follow these rules
- Use your own accounts and test data. Do not access, change or delete other people’s data.
- Stop as soon as you can show the problem, and tell us what you accessed.
- No denial of service, spam, physical attacks or social engineering.
- Keep the details private until a fix is out or 90 days have passed, whichever comes first.
4
What happens next
- A first answer within 7 days, confirming we received the report.
- An assessment and a planned fix, with updates while we work on it.
- Credit in the release notes if you want it.
5
Good-faith research
If you follow these rules, we treat your research as authorised and will not take legal action against you for it.
6 · Version history
Changes to this document
When this document changes, the version number goes up and the change is listed here.
- v1 · 12 Oct 2026First version