Reporting a vulnerability
If you find a security problem in a system Indaeo runs, send it through the contact form and choose “A security issue”.
Include enough for someone to reproduce it: the address or endpoint, what you did, what happened, and what you expected instead.
What to report
- indaeo.com and every page on it
- app.indaeo.com, where Indaeo AI runs
- the application form and the systems behind it
- email sent from Indaeo's domain
These four are in scope. Anything else is out of scope.
What Indaeo cannot authorise
Indaeo’s clients own their Shopify stores. Indaeo cannot give anyone permission to test a store, and a problem in a store goes to that store.
Services that third parties run for Indaeo are theirs to authorise. A problem in one of them goes to that provider.
How to test
- Use only your own data and your own accounts. If a test needs access you do not have, ask through the contact form first.
- Stop at the first proof. One request that shows the problem is a finding.
- If you reach anyone else's data, stop and report it. Do not read further, change, keep or share it.
- Do not disrupt a service: no attempt to take it offline, flood a form or slow the site for anyone else.
- Do not test by phishing or otherwise deceiving the Indaeo team or Indaeo's clients, and do not test physically.
- Keep the details private until the fix is live.
What Indaeo does with a report
Indaeo reads every report and replies to every reporter who leaves a way to answer. It checks whether it can reproduce the problem, fixes a problem it confirms, and tells you when the fix is live.
Safe harbour
Research that follows this page is authorised by Indaeo. For that research, Indaeo will not bring or support legal action against you, and does not treat it as a breach of the rule in the Terms against testing the site’s security.
If someone else brings legal action against you over research that followed this page, Indaeo will make it known that the research was authorised.
This covers only the systems listed under What to report, and only claims Indaeo controls. It does not cover a client’s store or a third party’s service, research that breaks the rules on this page, or research used to threaten Indaeo or anyone else. If you are unsure whether something is allowed, ask through the contact form before you test.
Questions
- Is a missing security header a report on its own?
- No. If it is a step in a working exploit, send the exploit.
- Is a client's Shopify store in scope?
- No. Report a problem in a store to that store.
- Is scanner output a report?
- No. A report needs the steps that reproduce the finding.
- Can I report without giving my name?
- Yes. The contact form needs a name and an email address, but neither has to identify you. Indaeo can reply only to an address that works.
- Can I publish the finding?
- Yes, once the fix is live. Tell Indaeo the date you plan to publish, and Indaeo will work to it.
Last updated: 14 October 2026