Responsible disclosure

Last updated: 28 August 2026

If you have found a security vulnerability in mnd8t, we want to hear from you, and we will not take legal action against you for research conducted in good faith under this policy.

How to report

Email security@mnd8t.com with enough detail to reproduce the issue: the affected endpoint or page, the steps, and what an attacker could achieve. Please report privately and give us reasonable time to remediate before disclosing publicly.

Do not include real customer data in your report. If a proof of concept requires an account, create your own sandbox account.

What we commit to

  • We will acknowledge your report within 3 working days.
  • We will give you an initial assessment within 10 working days.
  • We will keep you updated while we remediate, and tell you when it is fixed.
  • We will credit you when we publish a fix, if you would like us to.

We do not currently operate a paid bug bounty. That may change; this page will say so when it does.

In scope

  • mnd8t.com and the mnd8t dashboard
  • The mnd8t API
  • Evidence receipt generation, signing and verification
  • Authentication, session handling, and tenant isolation

Tenant isolation and anything that could cause a decision to be recorded inaccurately are the findings we care about most.

Out of scope

  • Customer executors. The code that holds payment credentials and executes approved actions runs in the customer's own environment, outside our trust boundary. Report those to the customer.
  • Third-party services we depend on — report to them directly.
  • Denial of service, volumetric or stress testing against production.
  • Social engineering of our staff, customers or suppliers, and physical attacks.
  • Findings from automated scanners with no demonstrated impact.
  • Missing hardening headers, or best-practice suggestions, with no exploitable consequence.
  • Vulnerabilities requiring a compromised device, a rooted phone, or a privileged position already inside a customer's own systems.

Safe harbour

If you act in good faith under this policy — you avoid privacy violations, data destruction and service degradation, use only your own test accounts, stop as soon as you have demonstrated a problem, and give us reasonable time before disclosure — we will treat your research as authorised, will not pursue or support any claim against you, and will say so if a third party raises one.

A note on the architecture

Some classes of compromise are bounded by design rather than by our diligence, and this is worth knowing before you look. mnd8t holds no customer funds, no payment credentials and no private keys — only a single Ed25519 key used to sign evidence receipts. There is no execution code path in the service. An attacker who fully compromised mnd8t could corrupt decisions and evidence, but could not directly move money.

This makes signing-key compromise and tenant isolation the highest-severity areas, and we treat reports there accordingly.