01 Report a vulnerability
If you think you have found a security issue in this website or in huereo, email hello@supermerco.com with “Security” in the subject. Include what you found, how to reproduce it, and what an attacker could do with it.
We will acknowledge your report within 3 working days, keep you updated while we work on it, and credit you if you would like. We do not run a paid bug bounty at the moment.
02 Please stay within these rules
- Test only against your own accounts and data. Do not access, change or delete anyone else’s data.
- Do not run denial-of-service tests, spam our forms, or use social engineering or physical attacks.
- Give us reasonable time to fix an issue before you tell anyone else about it.
03 Good-faith research
If you follow these rules and act in good faith, we will not take legal action against you for your research.
04 How this website is protected
- HTTPS everywhere, with HSTS and a strict Content Security Policy.
- No tracking cookies, and no third-party scripts, trackers or fonts.
- The contact form only accepts requests from this site, with rate limits, a bot trap and a size cap.
- IP addresses stored only as keyed one-way hashes.
05 The product
huereo is built to run inside your environment with outbound network access disabled. Its security model is on the Trust page.