Vulnerability Disclosure

Contact: security@summitdesk.io

SummitDesk welcomes good-faith reports for security vulnerabilities that could affect SummitDesk accounts, dealer workspaces, customer data, or production services.

What to Include

• Affected URL, endpoint, account surface, or function name
• Impact and the data or capability that could be exposed
• Clear reproduction steps using test accounts or your own data
• Screenshots, timestamps, request IDs, or logs when available

Rules of Engagement

• Do not run destructive testing or denial-of-service testing.
• Do not send spam or test credential stuffing, brute force, or social engineering.
• Do not access, modify, delete, export, or disclose real customer, dealer, or OEM data.
• Do not persist access or use a finding beyond what is needed to demonstrate impact safely.

Bug Bounty Status

SummitDesk is not running a paid bug bounty program. Reports are reviewed under this vulnerability disclosure policy, and no reward or payment is promised.