Responsible Disclosure Policy

Email security@bancoos.com [TO CONFIRM] with: a description of the issue, steps to reproduce, the affected URL/endpoint, and any proof-of-concept. Please report in English or Vietnamese. If the finding involves personal data, include the minimum needed to demonstrate it.

• Acknowledgement within 2 business days.
• A triage decision and severity within 7 business days.
• We keep you informed through remediation and credit you (if you wish) once fixed.
• Safe harbor: we will not pursue legal action for good-faith research that follows this policy. [Safe-harbor wording TO CONFIRM with Vietnamese counsel.]

• Test only against accounts and organizations you own or created for testing.
• Never access, modify, or exfiltrate another customer's data — if you can, stop and report immediately.
• No denial-of-service, spam, physical, or social-engineering attacks.
• Do not publicly disclose before we've had a reasonable window to fix (coordinated disclosure; default 90 days).

• The BancoOs web application and API (app + api origins).
• Authentication, session handling, and tenant-isolation boundaries (our favorite reports).
• Document ingestion and AI-extraction pipeline abuse.

Out of scope: our subprocessors' own platforms (report to them), findings requiring a compromised device, and reports from automated scanners without a demonstrated impact. No paid bounty program exists yet; meaningful findings earn public thanks and swag while the program matures.