gurado — Security & Responsible Vulnerability Reporting
At gurado, protecting our customers, merchants, and their data is a priority.
This policy explains how security concerns may be reported, the requirements for security testing, and how gurado handles vulnerability reports and coordinated disclosures.
gurado does not authorize independent security testing, penetration testing, vulnerability exploitation, or automated security scanning of its systems without prior explicit written authorization.
This restriction applies to all gurado-owned or operated websites, subdomains, applications, APIs, administrative interfaces, infrastructure, and associated services.
Public availability of a website, API, or service does not constitute permission to conduct security testing.
Individuals or organizations wishing to conduct security testing must obtain written authorization from an authorized gurado representative before beginning.
Such authorization must specify the permitted systems, testing methods, duration, and applicable restrictions.
Unless expressly authorized in writing, all gurado systems and services are outside the scope of independent third-party security testing.
This policy provides a channel for reporting suspected vulnerabilities. It does not grant authorization to discover, verify, or exploit vulnerabilities through otherwise unauthorized activities.
Without prior written authorization, the following activities are not permitted:
If you inadvertently encounter sensitive information or identify a potential security weakness during ordinary authorized use, discontinue the relevant activity and report the matter promptly.
Do not perform additional testing or attempt to demonstrate the vulnerability's impact without written authorization.
We welcome good-faith reports of suspected security vulnerabilities, including those identified without conducting security testing.
Please submit reports to:
Email: security@gurado.de
Where possible, include:
Please do not send passwords, active authentication tokens, voucher codes, personal data, or other sensitive information unless gurado has provided an appropriate secure method for transmission.
Submitting a report does not constitute authorization to perform additional testing.
We ask researchers to report suspected vulnerabilities directly to gurado and allow a reasonable opportunity to investigate, remediate, and coordinate any disclosure.
We request that vulnerability details, exploit information, screenshots, and other security-sensitive findings are not publicly disclosed before coordination with gurado.
Please refrain from contacting gurado's customers, merchants, or partners regarding reported vulnerabilities without prior coordination.
Where public disclosure is contemplated, we encourage researchers to contact gurado beforehand to discuss an appropriate disclosure timeline that considers the severity of the issue, remediation progress, and potential risks to affected parties.
Nothing in this policy is intended to prevent lawful reporting to competent authorities, legally protected disclosures, or compliance with applicable legal obligations.
gurado does not operate a public bug bounty program and does not guarantee financial rewards for unsolicited vulnerability reports.
Submitting a vulnerability report does not create any entitlement to payment, compensation, or other rewards.
As a gesture of appreciation, gurado may, at its sole discretion, offer gift vouchers, company merchandise, or other forms of recognition for helpful, responsibly submitted reports.
Any such recognition is entirely voluntary, is not guaranteed, and does not establish a bug bounty program or entitlement to future rewards.
Any paid security testing must be separately agreed upon and explicitly authorized in writing before testing begins.
gurado reviews vulnerability reports received through its designated security contact and assesses their potential impact.
We aim to acknowledge actionable reports within five business days, although response times may vary.
Depending on the nature of the report, gurado may:
An acknowledgement of a report does not constitute confirmation that a vulnerability exists.
Investigation and remediation timelines may vary depending on severity, complexity, and operational requirements. No specific remediation deadline is guaranteed.
This policy provides a mechanism for responsible vulnerability reporting but does not grant permission to access, scan, test, or exploit gurado systems.
All independent third-party security testing requires separate, explicit written authorization.
gurado reserves its rights under applicable law concerning unauthorized access, misuse of systems, misuse of confidential information, and other unlawful activities.
The submission or acknowledgement of a vulnerability report does not constitute authorization for prior or subsequent security testing.
Nothing in this policy restricts statutory rights, mandatory reporting obligations, or disclosures protected by applicable law.
gurado may modify or update this policy from time to time. Any authorization for security testing must be granted separately in writing by an authorized gurado representative.