Vulnerability disclosure

In scope: the pierrr.com website, the app.pierrr.com dashboard, the api.pierrr.com API, the agents entry point and the Pierrr Agent software. Out of scope: applications hosted by our customers (report them to the customer concerned), third-party services, and tests that degrade the service, including denial of service attacks, excessive request volumes, social engineering, phishing of our team and physical access.

Write to team@pierrr.com with "Security" in the subject line. Include: the nature of the flaw, the steps to reproduce it, the impact you estimate, the evidence (without real customer data), and your contact details if you want a reply. Do not put third parties' personal data in your report.

• Test only with your own accounts and your own projects.
• Do not access, modify or delete another customer's data. If you reach it by accident, stop, do not copy it and tell us.
• Do not use the flaw beyond what is needed to show that it exists.
• Do not degrade the service or make it unavailable to others.
• Do not disclose the flaw publicly until it is fixed or the agreed period has passed.

• We acknowledge your report within 5 business days.
• We keep you informed of progress and tell you when the flaw is fixed.
• We will not take legal action against someone who acted in good faith and within these rules, and we will not ask third parties to do so on our behalf. We cannot bind third parties whose services may be affected.
• With your agreement, we credit your contribution once the flaw is fixed.

We do not offer a financial reward at this stage.

We ask for a reasonable time to fix, at most 90 days from our acknowledgement, unless another period is agreed. If the flaw is already being exploited or seriously affects other customers, we act faster and tell you.