Contact

SECURITY

Vulnerability disclosure policy.

If you believe you have found a security issue in a Whalebium system, we want to hear from you. This page explains how to report it and what you can expect from us.

WORKING WITH RESEARCHERS

Good-faith research makes everyone safer.

We take every report seriously and work with researchers to understand and fix issues quickly. Please report vulnerabilities privately to our security team, not through the contact form or social media.

SCOPE

What you may test

In scope

  • whalebium.com and all of its subdomains
  • Whalebium products we host and operate, including Whalvi and PSAM
  • APIs served from those domains

Out of scope

  • Denial-of-service, load, or stress testing
  • Social engineering, phishing, or physical attempts against our people or offices
  • Services run by third parties, such as our CDN, email, or analytics providers. Please report those to the provider
  • Our clients’ systems, even if you found them through us
  • Low-impact findings with no working exploit: missing security headers, version banners, clickjacking on pages without sensitive actions, self-XSS, SPF/DMARC advisories

HOW TO REPORT

What to include

  1. The affected asset (URL, product, or version) and the type of issue
  2. Step-by-step instructions to reproduce it, with a proof of concept
  3. The impact: what an attacker could achieve
  4. How you would like to be credited, if at all

GROUND RULES

What we ask of you

  • Only test against accounts and data you own or have explicit permission to use.
  • Stop as soon as you have confirmed the issue. Do not access, change, or keep data beyond what is needed to show it. If you encounter personal data, stop, tell us, and delete it.
  • Do not degrade our services: no denial-of-service and no high-volume automated scanning.
  • Give us reasonable time to fix the issue before sharing details publicly. We will agree a disclosure date with you, normally within 90 days.
  • Do not ask for payment in exchange for withholding or releasing a finding.

OUR COMMITMENT

What you can expect from us

01

Acknowledge

We confirm we have received your report within 3 business days.

02

Assess

We validate the issue and share our initial severity assessment within 10 business days.

03

Fix and update

We keep you informed while we work on a fix, and tell you when it is resolved.

04

Credit

With your permission, we thank you publicly once the issue is fixed.

SAFE HARBOR

We will not take legal action against good-faith research.

If you follow this policy, we consider your research authorized. We will not pursue or support legal action against you for it, and if a third party takes legal action against you over activity covered by this policy, we will make it known that you acted with our authorization. If you are unsure whether something is allowed, email us before you go further.

We do not run a paid bug bounty at this time. For anything other than a security report, contact us here.

Last updated 4 October 2026