We take reports seriously. Here's how to send one.

01 Scope

This policy covers mondtic.com and its subdomains.

Client systems are out of scope. We do not authorize testing against systems we assess for clients — report those directly to the client that owns them.

02 How to report

Email security@mondtic.com. Encrypt sensitive reports with our PGP key, published at /.well-known/pgp-key.txt.

• A description of the issue
• Steps to reproduce it
• The impact you assessed

03 Safe harbor

We will not pursue legal action against good-faith research that stays within scope, does not degrade the service, does not access third-party data, and does not disclose before the agreed timeline.

04 Response SLA

We acknowledge new reports within 1 business day and complete initial triage within 3 business days.

05 Disclosure

We ask for a 90-day coordinated disclosure window before public release.

We coordinate the timing of any public disclosure with the reporter.

06 Rewards

We don't run a paid bug bounty program today.

07 Out of bounds

• Social engineering against our team
• Denial of service testing
• Physical testing
• Attacks against third-party providers