Security
Kayru holds data about tattoo studio clients, including signed health forms. If you have found a flaw, this page says how to tell us.
How to report
Write to contato@kayru.com.br with the word security in the subject. Include what makes it reproducible: the URL, the steps, what you expected and what happened. Portuguese is welcome too.
What you get back
There is no bounty programme. What there is, is an answer: an acknowledgement within 5 business days and, if the flaw holds up, the fix and word that it was fixed. Kayru is run by a small company; there is no on-call rota, and the deadline above is what can be honoured.
What we ask of you
- Do not use real people’s data. Create your own account and test on it.
- Stop once you have confirmed the flaw exists. You do not need to prove its reach by reading or changing another workspace’s data. If access happens unintentionally, say so in the same message.
- Do not degrade the service: no load testing, aggressive scanning, denial of service or mass guessing of passwords or tokens.
- Give us time before publishing: 90 days, or less if the fix lands sooner. If you disagree with that window, say so in the message rather than deciding alone.
- Do not pay for anyone’s information, and no social engineering against staff or clients, and no physical access. That is not security testing.
A good-faith report within these rules will not become a legal matter here.
Scope
In: kayru.ink, its subdomains, and the application answering on them. Out: third-party services (Stripe, Google, Meta and the host have their own channels — a flaw in how Kayru USES each one is ours), reports from automated tooling alone with no demonstrated impact, and missing headers with no concrete attack path.
A data subject request (access, correction, deletion) is not a security report and has another path: the privacy policy and the same contact address.