Vulnerability Disclosure Program
Flymode values the security of our systems and the responsible disclosure efforts of the security research community.
Found a security issue? Tell us responsibly.
If you believe you have identified a security vulnerability affecting Flymode systems or applications, we encourage you to report it responsibly through our coordinated vulnerability disclosure process.
Submit a ReportSafe Harbor
Flymode supports good-faith security research conducted in accordance with this policy.
We will not pursue legal action against researchers who follow this policy.
Act in good faith
Avoid privacy violations and service disruption
Do not access or modify customer data unnecessarily
Provide us reasonable time to investigate and remediate reported vulnerabilities
If you believe your testing may exceed these guidelines, please contact us before proceeding.
What makes a great report
A clear, complete report helps our team verify and remediate faster — and keeps researchers safe from misuse claims.
- Clear vulnerability description
- Reproduction steps
- Impact assessment
- Supporting evidence
- Affected URLs / assets
- Denial-of-service testing
- Spam / scanner floods
- Social engineering
- Accessing customer data unnecessarily
- Destructive testing
- Automated exploitation at scale
Scope
This program applies to production systems and services owned and operated by Flymode.
- Production web applications under *.flymode.io
- Production APIs
- Official Flymode mobile applications
- Publicly accessible production infrastructure owned by Flymode
- Electron POS
Domains & Subdomains
*.flymode.in#test#.flymode.io#staging#.flymode.io#dev#.flymode.io#stag#.flymode.io
Activities & Environments
- Staging, development, QA, testing, or temporary environments
- Third-party services or integrations not controlled by Flymode
- Social engineering or phishing attacks
- Physical attacks
- Denial-of-service testing
Out-of-Scope Vulnerabilities
Reports limited to the following classes are typically closed as informative. Submitting a working PoC that demonstrates real impact may still qualify.
Broken link hijacking
Low severity only
Google Maps API key exposure
No demonstrated impact
Clickjacking
Pages without sensitive actions
CSRF
Unauthenticated or non-sensitive actions
MITM or physical access attacks
Requires local access
Vulnerable libraries without PoC
No working proof-of-concept
CSV injection
No demonstrated impact
SSL/TLS best-practice issues
Configuration only
Disclosure Policy
Public disclosure is not permitted without explicit written authorization from Flymode.
Coordinating disclosure protects our customers while a fix is rolled out. Please wait for our written go-ahead before publishing any details, including blog posts, talks, or social media.
Submit a Report
All reports are handled confidentially. Email us directly — every report is acknowledged.