Report a vulnerability

If you believe you have found a security vulnerability in Instama, tell us at security@instama.co. We will not take legal action against research done in good faith under this policy.

How to report

• Write to security@instama.co with a description of the issue, the steps to reproduce it, and what an attacker could do with it.
• Include the addresses, accounts or requests involved, and any proof of concept.
• Write in English or Dutch.

What we promise

• We confirm receipt within 3 working days.
• We keep you informed while we investigate and fix the issue, and tell you when it is resolved.
• With your permission, we credit you when we publish the fix.
• We treat research that follows this policy as authorised, and we will not take legal action or ask law enforcement to act against you for it.

What we ask

• Test only with accounts you own or have permission to use, and never access, change or delete others' data.
• Stop as soon as you reach data that is not yours, and tell us what you saw.
• Do not run denial-of-service tests, spam, social engineering or physical attacks.
• Give us reasonable time to fix the issue before you disclose it publicly.

Scope

In scope: the Instama platform, its API and MCP server, the apps we build on that API (such as the Figma plugin), and the instama.co website. Out of scope: findings without a security impact (such as missing headers on pages without sensitive data), reports from automated scanners without a demonstrated issue, and the systems of our subprocessors, which you should report to them directly.

We do not run a paid bug bounty programme at this time.