# Krateo vulnerability disclosure
#
# Krateo is a household money app. Findings that reach a child's data, or that
# break privacy between family members, go to the front of our queue.
#
# Krateo has no security team and no on-call rotation. There is no bug bounty,
# and we do not promise a same-day reply. We do promise to read every report,
# to answer, and to tell you plainly what we did with it.
#
# BEFORE YOU START: the safe harbour in the Policy below is a PARTIAL one, on
# purpose. Three of its four tenets are in force. The missing one is the THIRD,
# the Terms of Service waiver: Krateo's Terms still prohibit probing, scanning
# and testing the security of the app, and the Policy page does not override
# them. Read it first. It says exactly what we can and cannot promise.
#
# The Policy is a statement of how we will act. It is not a contract, it is not
# legal advice, and it does not change the Terms of Service.
#
# IF YOU REACHED A CHILD'S OR A TEEN'S DATA: stop, keep no copy of it at all
# (not even one line), delete every copy you already have, and email us within
# 24 hours with CHILD DATA in the subject line. Describe it in words. Do not
# attach it, and do not publish it at any point.
#
# Reports in English, Portuguese, Spanish or French are welcome; the reply may
# come back in English.

Contact: mailto:security@krateomoney.com
Expires: 2027-08-09T23:59:59.000Z
Preferred-Languages: en, pt, es, fr
Canonical: https://krateomoney.com/.well-known/security.txt
Policy: https://krateomoney.com/security.html