The paperwork, in plain language

Email security@redesk.ai with steps to reproduce, the affected URL or endpoint, and the impact you believe it has. Encrypt with our PGP key if the finding is sensitive — the key is published at redesk.ai/.well-known/security.txt.

We acknowledge within 24 hours, give a first assessment within 5 business days, and keep you updated until it is closed.

• redesk.ai and all subdomains
• app.redesk.ai and the ReDesk platform APIs
• The RePrime mobile applications on iOS and Android
• ReLink device integration endpoints

• Findings from automated scanners without a demonstrated impact.
• Missing security headers or cookie flags with no exploit path.
• Social engineering, phishing, or physical attacks against our staff or offices.
• Denial of service, volumetric testing, or anything that degrades service for others.
• Vulnerabilities in third-party services we do not control — report those to the vendor.

Use only your own test accounts. Do not access, modify or exfiltrate other people's data — if you encounter it accidentally, stop and tell us. Give us reasonable time to fix before publishing, and we will credit you when we do.

If you follow this policy in good faith, we will not pursue or support legal action against you, and we will make that position clear to anyone who asks.

We run a discretionary reward programme. Severity, quality of the report and impact determine the amount; we publish a hall of fame with permission.