Report a Security Issue

Ennoki takes the security of our customers' data seriously. If you are a security researcher, a customer or simply an observant visitor and you have found something that looks wrong, we would like to hear from you.

1. How to Report

Email contact@ennoki.com with "SECURITY" in the subject line. Please do not post details publicly, on social media or in a product review before we have had a chance to respond.

2. What to Include

• A clear description of the issue and its potential impact
• The exact URL, page or endpoint affected
• Step-by-step instructions to reproduce it
• Screenshots, a short video or request/response logs where relevant
• The browser, operating system and date/time of your testing
• How you would like to be credited, if you wish to be

3. Our Response

4. Responsible Disclosure — Please Do

• Test only against your own account and your own data.
• Stop as soon as you have confirmed a vulnerability exists.
• Give us a reasonable period to fix the issue before any public disclosure.
• Delete any customer data you may have encountered during testing.

5. Please Do Not

• Access, modify, download or retain data belonging to another customer.
• Run denial-of-service, load or stress tests against the site.
• Send phishing or social-engineering attempts to our staff, suppliers or customers.
• Place fraudulent orders or attempt to manipulate pricing, discounts or stock.
• Deface pages, install backdoors or leave any persistent artefact behind.
• Demand payment in exchange for withholding disclosure.

6. Safe Harbour

If you follow the guidance above, act in good faith and give us reasonable time to respond, we will not pursue legal action against you for your research and will treat your report as an authorised contribution to our security.

7. Out of Scope

• Missing security headers, cookie flags or TLS configuration issues with no demonstrated exploit
• Reports produced by automated scanners without a working proof of concept
• Self-XSS, clickjacking on pages with no sensitive action, and social-engineering scenarios
• Vulnerabilities in third-party services we do not control — report those to the vendor
• Rate-limiting or brute-force findings on non-authentication endpoints
• Outdated browser or plugin issues on the reporter's own device

8. Rewards

Ennoki does not currently operate a paid bug bounty programme. We are glad to credit researchers publicly with their permission, and we always reply.

9. Phishing and Fake Stores

If you receive an email, text or call claiming to be from Ennoki that asks for a wire transfer, gift cards, cryptocurrency or your full card number, it is not from us. Forward it to contact@ennoki.com and delete it.

Our only website is ennoki.com and our only email address for customer contact is contact@ennoki.com. See also our Privacy Policy .