How to report a vulnerability and our coordinated disclosure policy.
If you discover a security vulnerability, please email us. We will acknowledge your report within 48 hours and provide a status update within 7 days. Please do not open a public issue.
security@susti.fiWe follow a 90-day disclosure window. We will work on a fix and keep you updated. After 90 days, or sooner if a fix is released, you may publish your findings. We credit reporters in release notes unless you prefer to remain anonymous.
In scope: susti.fi and all subdomains, the Sustifi web application, API endpoints. Out of scope: third-party services, denial-of-service attacks, social engineering.