Security support applies to the current deployed release identified by the release-evidence record. Source on main, staging, and production may differ; include the observed deployment URL and version when reporting an issue.

Email security@regengine.co. Do not open a public issue or include credentials, customer data, or unnecessary personal information.

Include the affected URL or operation, reproduction steps using disposable accounts and synthetic data, observed impact, and a secure contact method. The public policy is available at https://regengine.co/legal/vulnerability-disclosure.

The current RegEngine frontend, consolidated API deployment, authentication, authorization, tenant isolation, API-key handling, and evidence/export integrity are in scope when tested with accounts and tenants you control.

Denial of service, social engineering, physical attacks, unsolicited messages, access to another party's data, and testing third-party providers are out of scope. Stop and report immediately if non-synthetic data becomes visible.

RegEngine will acknowledge reports when the security inbox is monitored, validate scope and impact, and coordinate remediation and disclosure based on the specific finding. Any response-time estimates are operational targets, not contractual service levels. RegEngine does not currently operate a public bounty program.