Trust and security

Vulnerability disclosure policy

How to test carefully, report security issues privately, and coordinate remediation with Itemra.

Reporting contact: security@itemra.io is active and monitored by Brandsdal AS. This policy was prepared internally and has not been reviewed by external legal counsel.

Report a security issue privately

Send a concise security report to security@itemra.io. Do not send passwords, API keys, session tokens, private keys, or unnecessary personal/customer data. Include:

• the affected Itemra origin, route, or component;
• a clear description and the security impact;
• minimal, reproducible steps using accounts and data you control;
• relevant timestamps and sanitized request/response evidence; and
• a safe way to contact you about remediation and coordinated disclosure.

If sensitive proof is required, first ask for an approved encrypted transfer method. Do not attach a production database export or broad automated scan.

Scope

The intended scope is Itemra-controlled application behavior on itemra.io, docs.itemra.io, app.itemra.io, and api.itemra.io after those origins are publicly activated. Only test organizations, accounts, records, API keys, webhook receivers, and files you own or are explicitly authorized to use.

Third-party services and infrastructure, including WorkOS, Stripe, Resend, Azure, GitHub, DNS/registrar services, and their personnel, are outside this authorization. Report a third-party issue under that provider's policy unless the issue is caused by Itemra's integration behavior.

Research rules

• Avoid privacy violations, data access beyond your test data, persistence in another user's account, and any destructive change.
• Do not perform denial of service, load testing, spam, social engineering, physical intrusion, malware deployment, credential stuffing, or broad automated scanning.
• Stop when you encounter data that is not yours. Record the minimum evidence, do not copy it, and report immediately.
• Do not exploit an issue beyond the minimum needed to demonstrate impact.
• Do not publicly disclose an unresolved issue before Itemra has had a reasonable opportunity to investigate and remediate it.
• Comply with applicable law and this policy. This policy cannot authorize activity against a third party.

Authorization and good-faith research

Brandsdal AS provides written authorization under Section 5.1(c) of the Terms of Service for security research that stays within the scope and follows all research rules in this policy. This authorization does not extend to excluded systems, third-party services, other customers' data, or prohibited testing methods. If you are unsure whether an activity is covered, contact security@itemra.io before testing.

For good-faith research that follows this policy, Itemra intends to treat the work as authorized security research and not initiate legal action solely because you tested and reported the issue. If we believe your activity falls outside this policy, we intend to contact you and ask you to stop before taking further action where circumstances permit.

This statement does not waive third-party rights, authorize access to data or systems you do not control, or promise immunity from applicable law.

Response expectations

Itemra's best-efforts response targets are:

• acknowledge a complete report within three business days;
• provide an initial severity/triage response within ten business days;
• send a status update at least every ten business days while remediation is active; and
• coordinate a disclosure date after remediation, normally aiming for no more than 90 days unless exploitation risk, customer safety, or a dependency requires a different plan.

These are good-faith response targets, not a contractual support SLA or a promise that every report is a vulnerability. Duplicate, spam, incomplete, or out-of-scope submissions may receive a shorter response.

Recognition and rewards

Itemra does not currently operate a bug-bounty or guaranteed public acknowledgment program. Do not incur cost or expect payment without a separate written agreement. We will coordinate any optional credit with the reporter and will not publish a name or report without permission.