Vulnerability Disclosure Policy

Introduction: Qatoto is a B2B ecommerce, product research, development, and support platform where verified factory teams share daily product updates, raise funds from buyers and partners, and publish videos of ongoing research and development. Because our platform handles purchase orders, financial contributions, proprietary product designs, and internal team communications, the security of our systems is critical to the trust our users place in us. This Vulnerability Disclosure Policy explains how security researchers, customers, factory partners, and members of the public can responsibly report security issues to Qatoto.
Scope: This policy applies to all systems owned or operated by Qatoto that are reachable on the public internet, including the qatoto.com web application, our mobile clients, our public APIs used for catalog browsing and order placement, our daily factory update and R&D video pipelines, and the fundraising and payment flows used by factory teams. Third-party services we integrate with, such as payment processors, video content delivery networks, and identity providers, are governed by their own disclosure policies and are out of scope for this program; please report issues in those systems directly to the relevant vendor.
Reporting a Vulnerability: If you believe you have discovered a security vulnerability in any Qatoto system, please report it to us by email at security@qatoto.com. To help us triage your report quickly, include a clear description of the issue, the affected endpoint or component, steps required to reproduce the behavior, any proof-of-concept code or screenshots, and an assessment of the potential impact on factory teams, buyers, or contributors. Where possible, encrypt sensitive details using our published PGP key. We aim to acknowledge new reports within two business days and to provide a status update on triage and remediation within ten business days.
Researcher Guidelines: We ask that researchers act in good faith and avoid actions that could harm Qatoto, our factory partners, or our buyers while investigating an issue. Specifically, do not access, modify, or delete data belonging to other users, do not disrupt the daily factory update feed, fundraising flows, or R&D video uploads, and do not perform denial-of-service testing, social engineering against employees or factory teams, or physical attacks against our offices or infrastructure. Use only test accounts you create for the purpose of research, and stop testing immediately and contact us if you encounter personal, financial, or proprietary product data.
Out of Scope Issues: Reports that describe missing best-practice headers without a demonstrated security impact, theoretical attacks without a working proof of concept, vulnerabilities that require a fully compromised user device or rooted account, automated scanner output without manual validation, rate limits on non-authentication endpoints, and issues in third-party content uploaded by factory teams are generally considered out of scope. We may still review such reports, but they are unlikely to qualify for recognition or reward.
Safe Harbor: Qatoto considers security research conducted under this policy to be authorized activity. We will not pursue civil action or initiate a complaint to law enforcement for accidental, good-faith violations of this policy, and we will work with researchers to understand and resolve any issue quickly. This safe harbor does not apply to research that violates the researcher guidelines above, that targets individuals rather than systems, or that is performed by a Qatoto employee, contractor, or anyone otherwise prohibited by law from participating.
Recognition: We are grateful to the security community for helping keep our factory partners and buyers safe. With the reporter's permission, we publish the names or handles of researchers whose reports lead to a fix on our public security acknowledgements page. Where a reported vulnerability has a meaningful impact on Qatoto users, we may at our discretion offer a monetary reward; the amount is determined by the severity, the quality of the report, and the affected system.
Disclosure: We ask that researchers do not publicly disclose details of a vulnerability until we have confirmed that a fix has been deployed and any affected factory teams or buyers have been notified. We aim to coordinate a public disclosure timeline with the reporter, and in most cases we are able to publish a joint write-up within ninety days of the initial report.
Changes to this Policy: We may update this policy from time to time to reflect changes in our platform, our scope, or applicable law. The current version will always be available at this URL, and material changes will be communicated through our security acknowledgements page.
Contact Us: For security reports, questions about this policy, or requests for our PGP key, please contact us by email at security@qatoto.com.