Report a security vulnerability
Help us investigate a potential security issue in Bakasir. Reports submitted here are restricted to Super Admin in the platform support inbox.
How a report moves
Test within limits
Use a test account. Do not disrupt services or touch other people's records.
Document the finding
Affected page or API, minimal steps, expected and actual behaviour, and impact.
Submit privately
Send the form with a contact email. Redact tokens, credentials and personal data.
Restricted review
Reports land in a restricted inbox for Super Admin. They are not posted or forwarded by email.
What the program covers
This page grants no testing authorisation and promises no bounty. It tells you where a finding is most useful and what to leave alone.
In scope
- The Bakasir marketing site and public pages
- The Tenant Portal and browser POS
- Public and authenticated API endpoints
- Tenant storefronts on Bakasir subdomains
- Access control, tenant isolation and data exposure flaws
Out of scope
- Denial of service, load or spam testing
- Social engineering or phishing of staff or customers
- Physical attacks and access to other tenants' real data
- Third-party services such as payment providers and mail hosts
- Findings that need an unsupported browser or a rooted device
Submit a report
The report is stored in a restricted internal inbox, not posted publicly or automatically forwarded by email. Acknowledgement and resolution times are not yet published. Never include passwords or live payment information.
Before you submit
0 of 4 readyWhat to include
Describe the affected page or API, prerequisites, minimal reproduction steps, expected and actual behaviour, and the potential impact. Use a test account and redact tokens, credentials and personal data. Include a contact email for follow-up.
Keep the test limited
Do not disrupt services, access other people's records, perform denial-of-service tests or publish private information. This page does not grant testing authorisation or promise a bounty. Stop when you have enough evidence to explain the issue.
Not a security issue?
For plans, billing or setup questions, the Bakasir team replies by email.
Contact the Bakasir team