Draft for legal review. The wording is not final and may change.
Report a security issue
Found a vulnerability? Tell us and we will fix it fast. This page sets out what is in scope, how to test in good faith, and what we commit to.
Last updated: 28 September 2026
1. How to report
Found a security problem in Kreaza? We would like to hear about it, through the form at the bottom of the page. Describe what you found, where, and how to reproduce it step by step, and if possible what the impact is.
The report goes directly to the platform team. We will confirm that we received it within 3 business days, update you when we understand the problem, and tell you when it is fixed.
2. What is in scope
The site kreaza.com, the admin, the API, and the stores that run on Kreaza at *.kreaza.com addresses.
Out of scope: attacks that take the service down or overload it, social engineering of the team or of store owners, sending spam, physical testing, and third-party services that a store connected itself. A store's own domain is in scope only for the part served by Kreaza.
3. Rules for good-faith testing
Test only on an account and a store that you opened yourself. Do not access the data of other stores or customers. If you were exposed to such data by mistake, stop, do not keep or share it, and report it.
Do not delete or change data that is not yours, do not harm availability, and do not publish the problem before it is fixed or before 90 days have passed since the report, whichever is earlier.
4. What we commit to
We will not take legal action over the research against anyone who follows these rules in good faith, and we will regard such research as authorised activity.
At this stage there is no monetary reward for reports. With your consent, we will thank you by name when the fix is published.