Vulnerability Disclosure Policy

Reporting a Vulnerability

If you believe you have found a security vulnerability in any CaptiFi-owned service, please report it to us by emailing:

accounts@captifi.io

Please include the following in your report:

• A description of the vulnerability and its potential impact
• Step-by-step instructions to reproduce the issue
• Any supporting evidence such as screenshots, URLs, or proof-of-concept code
• Your name and contact details (optional, but helpful for follow-up)

What We Ask

• Give us reasonable time to investigate and address the issue before disclosing it publicly
• Do not access, modify, or delete data belonging to other users
• Do not perform actions that could degrade our services (e.g. denial of service attacks)
• Do not use automated scanning tools in a way that generates excessive traffic
• Act in good faith and comply with all applicable laws

What to Expect

• We will acknowledge receipt of your report within 3 business days
• We will investigate the issue and aim to provide a status update within 10 business days
• We will notify you when the vulnerability has been resolved
• We will not take legal action against researchers who follow this policy in good faith

Bug Bounty

We do not currently operate a paid bug bounty programme. However, we genuinely appreciate responsible disclosure and will credit researchers (with permission) for valid findings.

Scope

This policy applies to the following CaptiFi-owned domains and services:

• captifi.io (and all subdomains)
• The CaptiFi captive portal platform

Third-party services, integrations, and platforms not operated by CaptiFi are out of scope.