Security & Responsible Disclosure
We take the security of Nisura seriously and welcome reports from the research community.
Reporting a vulnerability
If you believe you have found a security issue affecting Nisura (nisura.eu, app.nisura.eu, or our API), please email security@nisura.eu. We read every report and aim to acknowledge within five business days. Our machine-readable contact is published at /.well-known/security.txt (RFC 9116).
What to include
A clear description of the issue, the affected endpoint or asset, and the steps or proof-of-concept needed to reproduce it. Please give us reasonable time to remediate before any public disclosure.
Scope & good-faith testing
Test only against assets you are authorized to test, and only your own accounts and data. Do not access, modify, or exfiltrate other users’ data, degrade service availability (no DoS or automated flooding), or use social engineering, physical, or spam-based techniques. Testing conducted in good faith and within this scope will not be pursued.
No bug-bounty program
Nisura does not currently operate a paid bug-bounty or vulnerability-reward program, and we do not offer monetary compensation for reports. We are grateful for responsible disclosure and are happy to credit researchers who wish to be acknowledged.
Our commitments
We will investigate every good-faith report, keep you informed of our remediation progress, and not take legal action against researchers who act in accordance with this policy.