Sign In
Book a demo
Start free trial

Responsible Disclosure Policy

At Gorelo, the security of our platform and our users’ data is our top priority. We recognize the important role that security researchers and our community play in keeping Gorelo secure. If you believe you have discovered a security vulnerability in our platform, we encourage you to let us know right away.

We will investigate all legitimate reports and do our best to quickly fix the problem. We ask that you follow this Vulnerability Disclosure Policy to ensure a safe and responsible disclosure process.

 

Safe Harbor

Gorelo strongly supports security research into our products. If you conduct your research and submit your findings in accordance with this policy, we will consider your actions authorized. We will not initiate legal action against you, nor will we ask law enforcement to investigate you, provided you comply with these guidelines.

 

Rules of Engagement

To protect our users and infrastructure, we require that you:

  • Do not access, modify, delete, or store user data that does not belong to you. Always test using your own accounts.
  • Do not execute Denial of Service (DoS/DDoS) attacks or any tests that impair access to or damage our systems.
  • Do not engage in social engineering (e.g., phishing, vishing), spamming, or physical security attacks against Gorelo employees, offices, or data centers.
  • Do not publicly disclose the vulnerability until we have had a reasonable amount of time to resolve the issue.
  • Do provide sufficient information for us to reproduce the vulnerability so we can address it as quickly as possible.

 

In-Scope Targets

  • *.gorelo.io
  • *.gorelo.tech
  • Gorelo Desktop/Agent applications (Windows/macOS)

 

Out-of-Scope Targets and Vulnerabilities

The following issues are generally considered out of scope unless they present a severe, chainable security impact:

  • Third-party applications, services, or tools integrated with Gorelo.
  • Clickjacking on pages with no sensitive actions.
  • Unauthenticated/logout/login CSRF.
  • Attacks requiring physical access to a user’s device.
  • Missing security headers that do not lead to a direct vulnerability.
  • Missing Best Practices (e.g., SPF/DKIM/DMARC configurations) without a proven, exploitable impact.
  • Software version disclosure or descriptive error messages.

 

How to Report a Vulnerability

If you have found a vulnerability, please email us at security@gorelo.io

To help us triage and prioritize your report, please include:

  1. Description: A clear description of the vulnerability and its potential impact.
  2. Steps to Reproduce: A detailed, step-by-step guide on how to reproduce the issue (Proof of Concept scripts or videos are highly appreciated).
  3. Environment: The browser, OS, and app version you used during testing.
  4. Remediation: Any suggested fixes or mitigations (optional).

 

What to Expect

When you submit a vulnerability report, we commit to the following:

  • Acknowledgment: We will acknowledge receipt of your report within 7 business days.
  • Triage: We will provide an estimated timeline for addressing the vulnerability within 21 business days.
  • Updates: We will keep you informed of our progress as we work to resolve the issue.
  • Recognition: With your permission, we would love to recognize your contribution on our Security Hall of Fame page once the vulnerability is fixed. Financial bounties may be considered at our discretion.

Thank you for helping keep Gorelo and our users safe!