How to report
Email incident@enigmalabs.ae. Plain text is fine; encrypt to our key if the details are sensitive. English, please.
What makes a report easy to act on:
- Where: the URL, endpoint, header, cookie, or feature involved, and which host you were on.
- What: a short description of the issue and the bug class you think it is.
- How: steps to reproduce, with the exact request, payload, or browser conditions. If we cannot reproduce it, we cannot fix it.
- Why it matters: what an attacker could realistically do with it, and to whom.
- Proof: the smallest PoC that shows it is real. We do not need a weaponised exploit chain.
Keep evidence minimal
Screenshots and request/response snippets are great. Trim them to what proves the point and redact anything that is not yours. Do not send credentials, session tokens, or personal data, yours or anyone else's. If you found exposed data, tell us what you saw and how you got there. Do not send us a copy.
One issue per email keeps threads sane. Anonymous or pseudonymous reports are fine; if there is no way to reply, we cannot send you updates, but we will still fix the bug. Skip the website contact form. It goes to the general inbox, not to security.
Encryption and key verification
If your report contains anything you would not want sitting in a plaintext mailbox, encrypt it to our OpenPGP key. It is tied to the reporting address and published two ways: as a downloadable file, and via Web Key Directory (WKD) so your client can fetch it straight from the address.
- User ID
- Enigma Labs Incident Response <incident@enigmalabs.ae>
- Fingerprint
3A16 070F 15E7 720D 9BBF 9B03 83E9 EBFE 0A5A 5923- Algorithm
- RSA, 4096-bit
- Created
- 4 September 2026
- Encryption subkey expires
- 3 September 2028
- Download
- https://openpgpkey.enigmalabs.ae/security/incident-public.ascThe same file is also served from this site at /security/incident-public.asc.
Fetch the key
With GnuPG, let WKD find it by address, or grab the file and inspect it before importing:
gpg --auto-key-locate clear,wkd --locate-external-keys incident@enigmalabs.aecurl -O https://openpgpkey.enigmalabs.ae/security/incident-public.asc
gpg --show-keys --with-fingerprint incident-public.asc
gpg --import incident-public.ascVerify the fingerprint
Before you encrypt anything, check the full 40-character fingerprint against the one on this page. All of it, not the short key ID; short IDs are trivially collidable. The key file comes from openpgpkey.enigmalabs.ae and this page from www.enigmalabs.ae, so a match across both hosts is a decent sanity check.
gpg --fingerprint incident@enigmalabs.ae
gpg --encrypt --armor --recipient 3A16070F15E7720D9BBF9B0383E9EBFE0A5A5923 report.txtIf they do not match, do not use the key. Send a plaintext email with no sensitive detail and tell us what you saw; that is a report in itself. Want an encrypted reply? Include your public key, or its fingerprint and where to fetch it.
Scope
Two hosts, and only the application layer we control on them. The infrastructure underneath belongs to Microsoft, Vercel, Cloudflare, and other vendors. We cannot authorise testing against their platforms, and they each run their own programmes if that is what you are after.
In scope
https://www.enigmalabs.aehttps://enigmalabs.ae, which redirects towww.enigmalabs.ae- Everything we ship on those hosts: pages, forms, cookies, headers, client-side code, and the configuration behind them
Out of scope
Unless we have explicitly agreed otherwise in writing:
- Any subdomain of
enigmalabs.aeother thanwww, includingopenpgpkey.enigmalabs.ae - Vendor infrastructure: edge networks, DNS, bot protection, consent management, analytics, and anything else the site embeds or calls
- Client environments, and anything we assess, defend, or build for clients
- Anything not listed under In scope. If it is not there, it is not in.
Rules of engagement
Manual testing and light automation are welcome. The rule is simple: prove the bug, then stop.
Fair game
- Poke at the site by hand: client-side code, headers, cookies, request and response behaviour, the usual.
- Run low-volume automated checks, like a scanner against a handful of pages at a sane rate. If you start seeing 5xx errors, slow responses, or rate limits, that is your cue to throttle down. You will not find anything new by going faster.
- Use only data you control. There are no user accounts here. Where the site takes input, use obviously fake test data, not real personal information. The contact form sends real email to real people and is rate-limited: a couple of clearly labelled test submissions are fine, flooding it is not.
- Stop at proof. No pivoting to other systems, no escalating, no seeing how deep it goes. A working PoC is enough; we will take it from there.
Off limits
- DoS, stress, load, or resource-exhaustion testing of any kind, high-volume scanning included.
- Credential stuffing, password spraying, or brute force against any login, ours or a vendor's.
- Social engineering, phishing, pretexting, spam, or turning up at the office. People are out of scope.
- Anything destructive or persistent: modifying or deleting data, defacing content, dropping backdoors or malware, or leaving anything behind. Leave it as you found it.
- Reading, copying, exfiltrating, or sharing other people's data, form submissions included. Seeing that it is exposed is the finding; the contents are not.
- Testing anything outside scope, vendor infrastructure included.
- Publishing or sharing details before we have coordinated disclosure (see how we handle reports).
Stumbled onto sensitive data? Personal information, credentials, internal material, whatever it is: stop right there. Do not read further, do not copy it, do not keep it. Tell us what you saw and how you got there, promptly. Handling this well is exactly what good faith looks like, and we will treat it that way.
Safe harbor
Research done in good faith and within these rules is authorised. Full stop. We will not initiate or support legal action against you for it: no civil claims, no complaints to law enforcement. If someone else comes after you for research that followed this policy, ask us and we will confirm that we authorised it.
Good faith, concretely: you followed these rules, you did not cause harm or violate anyone's privacy, you did not push an issue further than needed to prove it, and you gave us a fair chance to fix it before going public.
Where this stops
We can only speak for ourselves. This covers systems and rights Enigma Labs controls; it cannot authorise testing against third parties, including the vendors under Scope, and it does not bind them or anyone else. It is not blanket immunity either: the laws that apply to you still apply, and none of this covers activity outside these rules or done in bad faith.
Not sure? Ask first. If you cannot tell whether something is in scope or a technique is okay, email incident@enigmalabs.ae with the subject "Scope question". We would much rather answer a question than have you guess.
How we handle reports
- 1
We acknowledge your report within two business days
A real reply from a person, confirming we have it.
- 2
We triage it
We reproduce it, work out the impact, and tell you straight: accepted, need more info, out of scope, or not a security issue, with the reasoning either way.
- 3
We send you a status update every week
Every week the report stays open. If the update is no change, you will still hear it from us.
- 4
We tell you when it is fixed
Retest if you like; we would appreciate it. Then we agree disclosure and credit with you.
Coordinated disclosure
Give us a chance to fix it before you publish. Once we understand the issue and the fix, we agree how and when it gets disclosed, together. We do not put a fixed deadline on that here because the right timing depends on the bug, and we will not ask you to sit on a report forever either. If we cannot agree, we will tell you exactly where we stand rather than go quiet.
Want credit? Tell us how you would like to be named and we will sort out the form it takes once the fix has shipped.
Rewards
No bug bounty programme, no platform, no payout table. When a report shows real security impact we may send a thank-you, at our discretion. It is a gesture, not a fee.
Whether, what, and how much is our call, and sending a report does not create an entitlement to anything. Please do not hold details hostage for payment or quote a price before sharing them. At that point it stops being research, and it stops being covered by this policy.
About this policy
Published by Enigma Labs for the hosts under Scope, and referenced from our security.txt. The canonical URL is https://www.enigmalabs.ae/security.
Last updated 5 September 2026. We will revise it when we need to; whatever is published here is what applies.