Responsible Disclosure Policy

1. Report a security issue

Email support@hisabooks.com with the subject line Security Vulnerability. If the report relates to a specific page, API route, company workspace feature, or app build, include that context clearly in the message.

If your report contains sensitive reproduction details, say so in the first message and we will coordinate a safer way to exchange follow-up information if needed.

2. Covered systems

• Public HisaBooks websites and policy pages under approved HisaBooks-controlled domains.
• Authenticated company and admin web application routes.
• Public share links, customer portal links, and other token-scoped customer-facing routes controlled by HisaBooks.
• Official HisaBooks desktop and mobile application builds released by AARK.
• Documented APIs, authentication flows, billing flows, and notification/reporting integrations operated by HisaBooks.

Third-party processors, app stores, payment providers, SMS/email carriers, hosting-control panels, or any service not controlled by HisaBooks are not in scope for direct testing under this policy.

3. Safe testing rules

• Use only accounts, records, devices, and environments you own or are explicitly authorized to use.
• Stop immediately if a test exposes real customer data, payment data, payroll data, personal data, secrets, or unrelated account access.
• Do not change, create, delete, export, or retain another customer's data beyond the minimum proof needed to describe the issue.
• Do not run denial-of-service tests, brute-force attacks, spam, phishing, social engineering, malware, ransomware, or physical attacks.
• Do not intercept or tamper with traffic that is not your own, and do not test third-party providers directly.
• Do not publicly disclose the issue before coordinated review unless you are legally required to do so.

4. What to include

5. Out of scope and prohibited activity

The following are out of scope unless AARK gives prior written approval for a specific controlled exercise:

• Distributed denial-of-service, load, or stress testing.
• Automated bulk scanning that materially degrades service or triggers anti-abuse controls.
• Attempts to access another tenant's workspace, exports, receipts, payroll, or billing data.
• Any test involving payment-card collection environments, payment terminals, or processor dashboards not explicitly approved by the payment provider and AARK.
• Social engineering, phishing, impersonation, physical office visits, or supplier-account attacks.
• Retention of live secrets, personal data, backups, or customer documents after proof has been established.

6. Review and response process

We aim to acknowledge good-faith reports within five business days and may request clarification, reproduction detail, or proof-of-impact boundaries before confirming severity or remediation timing. Response timing can vary based on risk, operational safety, customer exposure, and whether third-party coordination is required.

AARK may restrict, log, suspend, or block activity that looks unsafe, abusive, or out of scope even if the actor later claims testing intent. This policy does not waive our rights to protect customers, systems, or providers.

7. Coordinated disclosure

Please give us a reasonable opportunity to investigate and mitigate the issue before public disclosure. If the issue affects a third-party dependency or provider, we may need to coordinate with that provider before sharing broader detail.

Where the issue may affect customer or regulator notifications, we will handle those communications according to applicable law, customer commitments, and our incident-response process.

8. No bug bounty or guaranteed compensation

HisaBooks does not currently operate a public bug bounty program, and this policy does not promise payment, reimbursement, public credit, contract rights, or a remediation deadline. Any discretionary recognition remains voluntary and may depend on report quality, business impact, and duplicate status.