If you believe you have found a security vulnerability in Caldyr, please tell us. This page explains what is in scope, what to send, and what you can expect from us.

What is in scope

caldyr.ai, app.caldyr.ai, admin.caldyr.ai, and the Caldyr agent install bundles that we publish. Other hosts and third-party services are out of scope.

What to send

The steps to reproduce the issue, the affected URL or component, and the impact as you see it. Please do not include customer data; a minimal proof is enough.

Where to send it

Email team@caldyr.ai. The same address is listed in our security.txt at https://caldyr.ai/.well-known/security.txt.

What happens next

We acknowledge your report within five working days. We then aim to fix by severity: critical within 7 days, high within 30 days, medium within 90 days, low in a regular release. We will tell you when it is fixed.

Safe harbour

We will not take legal action against research done in good faith that stays within this policy: do not disrupt the service, and do not access data beyond what is needed to prove the issue.

Rewards

We do not run a bug bounty programme and do not pay for reports.