Contact: https://trust.kuberm.com
Contact: mailto:security@kuberm.com
Expires: 2027-10-17T00:00:00.000Z
Preferred-Languages: en
Canonical: https://kuberm.com/.well-known/security.txt
Canonical: https://onerental.ca/.well-known/security.txt

# Responsible disclosure terms of Kuberm Labs Ltd. and its products, including OneRental.
# By testing for or reporting a vulnerability, you agree to these terms.

# How to report
# - Report suspected vulnerabilities privately through the trust center or by email to the contacts above.
# - Include enough detail to reproduce the issue, such as the affected URL or system, the steps taken, and the impact observed.

# Rules
# - Do not access, modify, download, retain, or share data that is not yours. If you encounter another person's data, stop and report it.
# - Do not disrupt or degrade any service, including through denial of service, load testing, spam, or automated scanning.
# - Do not use social engineering, phishing, or physical attacks, and do not test third-party services.
# - Do not disclose the issue, or any information about it, publicly or to any third party, without the prior written consent of Kuberm Labs Ltd.
# - Comply with all applicable laws.

# Out of scope
# - Clickjacking on pages with no sensitive actions.
# - Unauthenticated, logout, or login CSRF.
# - Attacks requiring a man-in-the-middle position or physical access to a user's device.
# - Denial of service, or any activity that could disrupt a service.
# - Content spoofing or text injection without a demonstrated attack vector.
# - Email spoofing.
# - Missing DNSSEC, CAA, or security headers.
# - Missing Secure or HttpOnly flags on non-sensitive cookies.
# - Broken links.
# - User enumeration.

# What to expect
# - Kuberm Labs Ltd. uses reasonable efforts to review reports it receives.
# - Kuberm Labs Ltd. is not obligated to respond to, act on, credit, or reward any report, and does not operate a bug bounty program.
# - These terms do not authorize any activity beyond what they permit, and do not waive any right or remedy of Kuberm Labs Ltd.