Found a vulnerability? Tell us.
If you find a security problem in Gripz, report it to us privately. We will not take legal action against good-faith research that follows this policy, and we will tell you what we did with your report.
Policy version 1.0 · effective2 October 2026
Opens an encrypted form. Prefer email? See "How to report" below.
How to report
Send enough for us to reproduce it: the affected URL or endpoint, the steps, and what an attacker could do.
Encrypted in your browser. Attach files up to 25 MB.
Our security.txt, at gripz.example/.well-known/security.txt
Contact: mailto:security@gripz.example Contact: https://gripz.example/security/report Encryption: https://gripz.example/security/pgp.txt Policy: https://gripz.example/security/disclosure Preferred-Languages: en, de Expires: 2027-10-02T00:00:00.000Z
Scope
Test against your own workspace. Never touch another customer's data.
In scope
- app.gripz.example
- api.eu.gripz.example, api.us.gripz.example
- widget.eu.gripz.example and the loader
- mcp.eu.gripz.example
- The iOS and Android apps, current version
- Help centers we host, including custom domains
Out of scope
- Denial of service and load testing
- Social engineering of our staff or customers
- Physical access to offices or data centres
- Our subprocessors' own systems: report to them
- Missing headers or best practices with no demonstrated impact
- Prompt injection that only changes the AI's tone. Report it if it leaks data or triggers an action.
Safe harbour
If you act in good faith and follow this policy, we consider your research authorised. We will not bring legal action or report you to law enforcement, and if a third party does, we will say publicly that you followed our policy.
Good faith means: stop as soon as you reach data that is not yours, do not keep or share it, give us a reasonable time to fix before you publish, and do not demand payment in exchange for the details.
What happens next
These are targets we hold ourselves to. A person on our security team keeps you updated at every step.
We acknowledge
Within 5 business days, with a reference number.
We assess
We confirm the issue, rate its severity and tell you the rating.
We fix
Critical issues within 7 days, high within 30. If affected customers need to act, we tell them directly.
We credit you
With your permission, on our acknowledgements page once the fix is live. We agree a publication date with you.
Bug bounty
A paid program is planned, not open yet
When it opens, its rules and reward table will be published here. Reports sent before then are still welcome and credited.