Sign inRegister

Security

Vulnerability Disclosure Policy

Last updated: July 2026

Inispo runs a gift-card marketplace, which means we take the security of our customers' accounts, orders, and payment data seriously. If you are a security researcher and you have discovered a vulnerability in one of our systems, this page explains how to report it and what you can expect from us. Thank you for helping keep Inispo and our customers safe.

Safe harbour — our promise to you

If you make a good-faith effort to comply with this policy during your research, we will consider your activity authorised, we will not pursue or support legal action against you, and we will work with you to understand and resolve the issue quickly. If a third party brings legal action against you for activity conducted in line with this policy, we will make it known that your actions were authorised.

1. How to Report

Email us at security@inispo.com. Please include enough detail for us to reproduce the issue:

  • The type of issue and the affected endpoint, URL, or app screen.
  • Step-by-step reproduction, including any request/response samples.
  • The impact — what an attacker could actually do.
  • Any proof-of-concept code, screenshots, or logs (please redact real customer data).

We aim to acknowledge your report within 3 business days and to keep you updated as we investigate.

2. Scope

The following are in scope:

  • inispo.com and its subdomains (*.inispo.com).
  • The Inispo mobile app (iOS & Android).
  • Our public APIs.
3. Out of Scope — please do not test these
  • Denial-of-service (DoS/DDoS), volumetric, or rate-based attacks.
  • Social engineering, phishing, or physical attacks against staff or offices.
  • Automated scanning that generates high traffic or spam.
  • Attacks requiring a compromised device, rooted/jailbroken phone, or MITM on the victim's own network.
  • Reports from automated tools without a demonstrated, exploitable impact.
  • Third-party services we use (e.g. payment provider, chat widget) — please report those to the vendor.
4. Rules of Engagement
  • Only test against accounts you own or have explicit permission to use.
  • Do not access, modify, or delete data that isn't yours. If you encounter customer data (card codes, personal info, payment data), stop and report immediately.
  • Do not run attacks that could degrade service for other customers.
  • Give us a reasonable time to fix the issue before any public disclosure, and coordinate the timing with us.
5. Recognition & Thanks

Inispo is a growing startup, and we genuinely value researchers who help protect our customers. We run a recognition-based disclosure program: while we do not currently offer monetary rewards, we will — with your permission — publicly credit you in our acknowledgements for valid, previously-unknown vulnerabilities you responsibly report. A credited disclosure from a fintech platform is something you can proudly point to.

What earns a credit:

  • First reporter only — duplicates of an already-known or already-reported issue are not eligible.
  • Real impact required — the issue must be reproducible and demonstrate concrete risk to accounts, orders, or data. Automated-scanner output, missing-header notices, and best-practice suggestions do not qualify.
  • In-scope only — see the scope and out-of-scope sections above.
  • Good-faith conduct — you followed the rules of engagement, did not access other users' data, and did not degrade service.

Recognition is a token of our thanks, offered at Inispo's discretion, and is not a contractual obligation.

6. Machine-Readable Policy

This policy is also published in machine-readable form at /.well-known/security.txt, in line with RFC 9116. For any questions about this policy, contact us at security@inispo.com.