Reporting a vulnerability

Written by Silas (SI), VP, Security & Reliability · Updated 2026-10-07

If you think you've found a security vulnerability in Defera, please report it to security@defera.app. We welcome reports from security researchers and customers alike, and we'll work with you to understand and fix the problem.

This policy explains how to report, what's in scope, how to test safely, and the protection we give to anyone who follows it.

How to report

Email security@defera.app with:

  • What you found, and where: the page, URL or feature involved.
  • How to reproduce it, step by step, with any screenshots or proof-of-concept code.
  • The impact, as you understand it: what someone could do with it.
  • How to reach you, and whether you'd like to be thanked publicly, and under what name.

One issue per report helps us move faster. Please don't include other people's personal data in a report. If you came across some, describe it instead.

What happens next

  • We aim to acknowledge your report within 3 business days.
  • We'll keep you updated while we investigate and fix it, and we'll let you know when it's fixed.
  • We may ask you questions to make sure we understand the issue.
  • We'll thank you, if you'd like. Once the issue is fixed, and with your permission, we'll credit you publicly by name or handle.

What's in scope

In scope: defera.app and www.defera.app, including the Defera web app and its API under defera.app/api.

Out of scope:

  • Services we use but don't run, such as our payment processors, email delivery, hosting and AI providers. Please report issues in those to the provider.
  • Social engineering, phishing, or physical attacks against Defera, our team or our customers.
  • Denial of service, load testing, or anything else that degrades the service for others.
  • Findings without a demonstrated impact, such as raw scanner output, missing best-practice headers on their own, email sender settings (SPF, DKIM, DMARC) or software version banners.
  • Low-risk issues such as self-XSS, sign-out CSRF, or clickjacking on pages with no sensitive actions.
  • AI answers. Getting our AI concierge to say something wrong or off-topic is out of scope, unless it exposes another customer's data or takes an action it shouldn't.

Rules for testing

To stay within this policy:

  • Use only accounts you own, or test accounts you create yourself. Never access, change or delete another person's account or data.
  • If you reach someone else's data, stop. View no more than you need to confirm the issue, don't keep or share it, and tell us right away.
  • Don't spend real money or use real travelers' details. Don't use a card that isn't yours, and don't place bookings you don't intend to keep.
  • Keep automated testing gentle. Respect our rate limits, and stop if you notice the service slowing down.
  • Give us time to fix it. Keep the issue confidential until it's fixed or 90 days have passed since your report, whichever comes first, and tell us before you publish. If we need more time, we'll explain why and agree a date with you.

Safe harbor

We consider security research that follows this policy to be authorized, and we won't take legal action against you, or ask law enforcement to act against you, because of it. Specifically:

  • This policy is our written authorization for research that follows it. We won't treat that research as a breach of our Terms of Service, including its sections on unauthorized system access and prohibited technical activities, and we waive those restrictions to the extent they would otherwise apply to it.
  • We consider it authorized under anti-hacking laws, done in good faith, and helpful to the security of Defera and our customers.
  • If someone else takes legal action against you over research that follows this policy, we'll make it known that we authorized it.
  • If you're not sure whether something is allowed, ask us at security@defera.app before you go ahead.

Safe harbor covers Defera's own systems only. Services run by others have their own policies, and we can't authorize testing of them. It doesn't cover activity that breaks this policy, such as viewing more of other people's data than you need or disrupting the service.

Rewards

We don't offer cash rewards for reports. What we offer is our thanks: once an issue is fixed, and with your permission, we'll credit you publicly.

Not a vulnerability?

Our security.txt file lists this contact for security tools.