Vulnerability Disclosure Policy

How to report a vulnerability in Obok, AgentMetal, AI SDR or www.inbest.cloud: scope, response targets, safe harbor and CVE assignment.

If you found a vulnerability in one of our products, we want to hear about it. This policy explains what you can test, how to report it, and how fast we respond.

Report vulnerabilities to: [email protected]

Scope

  • Obok: the FinOps SaaS platform operated by iNBest.
  • AgentMetal: the service at agentmetal.dev and api.agentmetal.dev, and the npm package @agentmetal/mcp.
  • AI SDR: the service at aisdr.inbest.cloud.
  • www.inbest.cloud: this website.

Out of scope

  • Client environments, even when iNBest manages them. Don't test them without written permission from their owner.
  • AWS, Microsoft Azure and Google Cloud as platforms. Report those vulnerabilities to the provider directly.
  • Third-party services we use, such as HubSpot on blog.inbest.cloud. Report those to that provider.
  • Denial of service (DoS or DDoS) and load testing.
  • Social engineering, phishing, and physical access to iNBest offices or staff.

How to report

Email [email protected] in English or Spanish. Include:

  • The product and the affected URL, endpoint or package version.
  • The type of vulnerability and its impact: what an attacker can do with it.
  • Steps to reproduce it, with requests, screenshots or a proof of concept.
  • How you'd like to be credited, or whether you'd rather stay anonymous.

If you saw other people's personal data while testing, describe it in the report without copying it.

Response targets

  • Acknowledgement: within 3 business days.
  • Triage: within 10 business days we tell you whether the vulnerability is valid and what severity we assigned.
  • Fix: we aim to fix each confirmed vulnerability within 90 days. If we need longer, we tell you and agree on a disclosure date with you.

We keep you updated until the fix ships. Please don't disclose the vulnerability before it's fixed or 90 days have passed since your report, whichever comes first, unless we agree on a different date.

Safe harbor for good-faith research

If you act in good faith and follow this policy, we consider your research authorized. We won't take legal action against you for it or ask law enforcement to. If a third party takes action over your research, we'll make it known that you acted under this policy. Good faith means:

  • Testing only with your own or test accounts.
  • Not accessing, changing or deleting other users' data beyond what you need to show the problem.
  • Stopping and reporting as soon as you confirm the vulnerability.
  • Not degrading the service for other users.
  • Not asking for payment in exchange for not disclosing.

Credit

With your permission, we credit you by name or handle in the matching security advisory at www.inbest.cloud/en/seguridad/avisos. We don't run a paid bounty program today.

CVE IDs

iNBest assigns CVE IDs for confirmed vulnerabilities in its products and publishes each one as an advisory at www.inbest.cloud/en/seguridad/avisos.