Security & Vulnerability Disclosure

Last updated: August 2026

Reporting a vulnerability

If you believe you've found a security vulnerability in the Sakeon website, platform, or infrastructure, please report it to security@sakeon.com. Include as much detail as you can: the affected asset, steps to reproduce, and potential impact. Encrypted reports are welcome. We'll provide a PGP key on request.

What we ask

Give us a reasonable amount of time to investigate and respond before any public disclosure
Make a good-faith effort to avoid privacy violations, data destruction, or service disruption
Only interact with accounts and data you own, or with explicit permission
Don't run automated scanning tools against production infrastructure without prior coordination

What you can expect from us

Acknowledgment of your report within 3 business days
An initial assessment of severity and validity within 10 business days
Ongoing updates as we work toward a fix
Credit in our security acknowledgments, if you'd like it

Safe harbor

We will not pursue legal action against researchers who make a good-faith effort to comply with this policy while researching and reporting a vulnerability.

Scope

This policy covers sakeon.com and Sakeon-operated infrastructure. It does not cover vulnerabilities in a customer's own self-hosted deployment. Those should be reported to that customer's internal security team, or coordinated with Sakeon support if platform code is implicated.

machine-readable disclosure file