Report a finding
Email [email protected] with the affected asset, impact, reproduction steps, timestamps and relevant request IDs. Use MANDATE-owned test surfaces, your own tenant, or environments where you have explicit written authorization. Do not include customer data or publish working bypass steps before coordinated disclosure.
In scope
MANDATE-owned public web properties and demo environments; your own MANDATE tenant, keys and integration code; privacy-safe evidence of verification bypass, token misuse, authentication weakness, tenant isolation issues or data exposure.
Out of scope
Third-party customer systems without authorization, denial of service, social engineering, spam, credential stuffing, attempts to access customer data, extortion and selling bypass tools.
Recognition and rewards
Recognition is opt-in after coordinated disclosure. MANDATE does not operate a public cash bounty. Reports submitted before a bounty exists are not automatically eligible for retroactive payment.
Existing safe-harbor policy
We will not pursue legal action against researchers who follow this policy, report in good faith, and give us reasonable time to investigate. This does not extend to attacks on third-party customers, disruption of production traffic, data theft, extortion, or selling bypass tools.