Responsible Disclosure

How to report

Email security@nolte.io with enough detail for us to reproduce the issue: the affected URL or asset, a description of the vulnerability, and the steps to trigger it. Proof-of-concept material is welcome. If you would like to encrypt your report, ask us for a key in your first message.

What to expect

• We will acknowledge your report as quickly as we can, and aim to do so within a few business days.
• We will keep you updated as we investigate and work toward a fix.
• We are happy to credit you once an issue is resolved, if you would like to be named.

We do not currently run a paid bug-bounty program. This is a coordinated-disclosure channel, not a bounty.

Scope

This policy covers nolte.io and its subdomains. Our infrastructure providers (Netlify, and the subprocessors listed on our DPA and subprocessors page) run their own disclosure programs; please report issues in their platforms directly to them.

Safe harbor

If you make a good-faith effort to comply with this policy during your research, we will consider your activity authorized, we will not pursue or support legal action against you for it, and we will work with you to understand and resolve the issue. Good faith means:

• You avoid privacy violations, data destruction, and any degradation of our service (no denial-of-service or spam testing).
• You only access or modify data that belongs to you, and you stop and report as soon as you encounter data that is not yours.
• You give us a reasonable chance to fix an issue before disclosing it publicly.
• You do not exploit an issue beyond what is necessary to demonstrate it.

Contact

security@nolte.io

Last reviewed: October 13, 2026.