Responsible Disclosure
Security researchers make platforms like this safer, and we'd rather hear about a hole from you than from an incident. If you've found a vulnerability in Fadelio, this page is the safe way to tell us.
1The deal
Report in good faith, within the rules below, and we will never take legal action against you for it.
That's the safe harbour, in one sentence. Good-faith research that follows this policy is authorised use of the platform for the purposes of our Acceptable Use Policy — the “no probing” rule exists for attackers, not for you.
2How to report
Email hello@fadelio.com with SECURITY in the subject line. Include what you found, where (URL, endpoint, tenant), steps to reproduce, and what you think the impact is. A proof-of-concept is welcome; a working exploit chain in the first email is not required. If it's sensitive, say so and we'll arrange a safer channel before details are shared.
3The rules of engagement
- Don't touch real shops' data. If access to someone else's data is the finding, stop at proving it exists — don't read, copy or alter more than the minimum proof.
- No service disruption — no denial of service, no load testing, no destructive actions.
- No social engineering of our team or of shops on the platform, and no phishing.
- No spam — don't use a finding to send messages to anyone.
- Give us time to fix — please don't publish details until we've confirmed a fix or 90 days have passed, whichever is first.
4What we promise
A human reply within 3 working days. An honest assessment of impact, and a fix timeline you can hold us to. Credit for the find, if you want it, once it's fixed. We don't run a paid bounty programme today — we're a young company and won't promise money we can't guarantee — but real findings have real gratitude, and this page will be updated (see the version history) if that changes.