Responsible Disclosure Policy

This policy explains how to report a security vulnerability you find in EnaFeedback or its related services. We value the good-faith work of security researchers and take every report seriously.

This English text is a translation. In case of conflict, the Turkish version prevails.

1. How to reportCopy Anchor Link

Send your report to support@enainnovation.com. Where possible, include:

• the type of vulnerability and the affected address, application or version
• step-by-step instructions to reproduce it
• a proof of concept (screenshot, sample request/response, short video)
• an assessment of the likely impact
• a suggested fix, if you have one
• how we can reach you

You may write in Turkish or English. Please do not disclose the vulnerability publicly or to third parties until it is fixed.

2. ScopeCopy Anchor Link

In-scope systems:

Out of scope:

• ENA Innovation domains and services not listed above. You may still report findings about them, but the assurances in Section 4 apply only to in-scope systems.
• Third-party services and infrastructure (for example cloud hosting, DNS and proxy services, the identity service, email and SMS providers, AI providers). Report vulnerabilities in these services to the provider concerned.
• Denial-of-service (DoS/DDoS), load testing and high-volume tests that push rate limits
• Social engineering, phishing and attempts targeting ENA Innovation staff or customers
• Physical attacks; tampering with posters, NFC tags or displays in customer premises
• Automated scanner output submitted without demonstrated exploitability
• Missing or weak security headers, version disclosure or SPF/DKIM/DMARC configuration suggestions without a concrete attack scenario
• Clickjacking on pages with no sensitive actions, logout CSRF and self-XSS
• Findings that require physical access, a rooted/jailbroken device or an outdated browser
• Low-impact information disclosure, such as being able to tell whether a username or email address exists

3. RulesCopy Anchor Link

During your research:

• Use only your own account or a test environment you have been explicitly given. You can request a test environment at support@enainnovation.com.
• Do not access, change or delete data in real customer environments. Do only the minimum needed to demonstrate the vulnerability.
• If you unintentionally reach personal data or data belonging to another organization, stop, do not copy or keep the data, tell us immediately and delete any copies you hold.
• Do not run tests that degrade the availability or performance of the Service.
• Do not send test data to real visitor forms, hygiene ratings or notification channels.
• Do not establish persistence on a system you gain access to, escalate privileges beyond what is needed or move to other systems.
• Do not share the vulnerability before it is fixed or before the date agreed with us.

4. Safe harborCopy Anchor Link

For research carried out in good faith and in line with this policy, ENA Innovation:

• considers your research authorized
• will not take legal action or file a complaint against you
• will, if a third party takes action against you because of your research, state that you acted in line with this policy

This assurance is limited to ENA Innovation's own rights. ENA Innovation cannot make commitments about actions by public authorities or third parties. If you are unsure whether an activity is consistent with this policy, ask us before you start.

5. Our response targetsCopy Anchor Link

We prioritize confirmed vulnerabilities by severity. Our remediation targets are:

These periods are targets, not commitments. Complex issues or fixes that depend on third-party components may take longer; we will keep you informed if so.

6. Coordinated disclosureCopy Anchor Link

If you want to disclose the vulnerability publicly, do so after the fix is released and on the date agreed with us. By default we suggest 90 days after your report. Your disclosure must not include customer data or personal data.

7. Recognition and rewardsCopy Anchor Link

ENA Innovation does not currently run a paid bug bounty program. For valid in-scope reports, and with your permission, we may name you in our acknowledgements list.

8. ContactCopy Anchor Link

This policy is published in Turkish and English. In case of conflict, the Turkish version prevails.