Coordinated Vulnerability Disclosure

Version: 1.0 · Effective Date: 2026-09-11 · Last Updated: 2026-09-11

Introduction

At Kimbino Green s. r. o., we are committed to ensuring the security of our products and services. We recognize the critical role that security researchers play in identifying vulnerabilities and helping us protect our users.

This Vulnerability Disclosure Policy outlines how to responsibly report security vulnerabilities to us, our commitment to acknowledging and addressing reports, and the protections we offer to researchers who follow our guidelines.

Scope

This policy applies to products and services provided by Kimbino Green s. r. o., including:

• Kimbino - mobile applications (Android, iOS) and their supporting backend/API
• Kimbino - web platform
• Kimbino browser extension - Kimbino - deals, discounts, leaflets

If you are unsure whether a system or asset is in scope, please contact us before testing — we will clarify.

Out of scope

• Social engineering attacks (against our staff or users)
• Third-party vulnerabilities and systems not operated by us
• Physical security issues
• Software not developed or maintained by us

How to Report

Primary contact: security@kimbino.com

Contact: Security Team

We accept reports in English

Please include

• Vulnerability type (e.g. SQL injection, XSS, authentication bypass)
• Affected component (e.g. web application, API, mobile app, firmware)
• Affected version(s)
• Description of the vulnerability
• Steps to reproduce (with code samples if applicable)
• Impact assessment (data exposed, functions affected, business impact)
• Your contact information (for follow-up; optional for recognition)
• Previous disclosure (whether you have reported this elsewhere)

Our Commitment

What we do: assess the vulnerability's severity and impact → verify the issue → develop a fix → test it thoroughly → release a security update.

Guidelines for Researchers (Rules of Engagement)

To qualify for the safe harbor below, when researching please:

• Do not access, modify, or delete data that does not belong to you; only use test accounts or data you own.
• If you encounter personal data or other confidential information, stop immediately — do not access, copy, store, transfer, or otherwise use it — and tell us in your report. Access no more data than is strictly necessary to demonstrate the issue.
• Do not exploit a vulnerability beyond what is necessary to prove it exists.
• Do not disrupt or degrade our services (no DoS/DDoS, spam, or large-scale brute forcing; no automated scanning that could impact availability).
• Do not use social engineering, phishing, or physical attacks against our staff, users, or facilities.
• Do not publicly disclose the vulnerability until we have had reasonable time to fix it (typically 90 days), unless we agree otherwise.
• Comply with all applicable laws.

Safe Harbor

We will not pursue or support legal action against security researchers who discover and report vulnerabilities in good faith and comply with this policy, including the Rules of Engagement above. We consider such activity authorised and beneficial.

This safe harbor does not authorise activity that violates applicable law, and it does not extend to third-party systems or data.

Legal and Regulatory Reporting

Nothing in this policy limits our ability — or our legal obligations — to report vulnerabilities or incidents to competent authorities. In particular, where a vulnerability in our products is being actively exploited, or where a severe security incident occurs, we may be legally required to notify the relevant authorities (for example, ENISA and the competent national CSIRT under the EU Cyber Resilience Act, Regulation (EU) 2024/2847). We will handle any such reporting in a way that does not unnecessarily expose you or our users, and — where appropriate — we will keep you informed.

Rewards

We do not currently offer monetary bounties or rewards for vulnerability disclosures through this program.

Questions

If you have questions about this policy or need further assistance, please contact our security team at security@kimbino.com.