Effective 2026-10-18
1. Our commitment
Mediaura welcomes reports from security researchers and the public about vulnerabilities in our websites and services. If you make a good-faith effort to follow this policy, we will work with you to understand and fix the issue quickly, and we will not pursue legal action against you for your research.
Mediaura does not run a paid bug bounty. We do not offer monetary rewards. With your permission, we are glad to credit you publicly once a fix is released.
2. Scope
In scope:
- mediaura.io and its subdomains, including the Mediaura Signal application.
- mediaura.com and its subdomains, including approvals.mediaura.com and atlas.mediaura.com.
Out of scope:
- Websites Mediaura builds or hosts for its agency clients on their own domains. Report those to the site owner.
- Third-party services we use (for example AWS, Google Workspace, HubSpot, Slack). Report those to the vendor under its own program.
- Findings with no security impact, such as missing best-practice headers with no exploit, clickjacking on pages with no sensitive actions, SPF/DMARC policy suggestions, or software version disclosure.
3. Rules for testing
- Do not access, change or delete data that does not belong to you. If you encounter personal information, protected health information (PHI) or customer data, stop, do not keep or share it, and tell us right away.
- Do not run denial-of-service tests, or any test that degrades service for other users.
- Do not use social engineering, phishing or physical attacks against Mediaura personnel, offices or customers.
- Use only accounts you own or that we give you. Do not test other users’ accounts.
- Use automated scanners only at low rates that do not affect availability.
- Do only what is needed to demonstrate the issue. Do not pivot to other systems, keep persistent access or plant backdoors.
4. How to report
Email security@mediaura.com with:
- the affected URL, host or component;
- a description of the vulnerability and its potential impact;
- step-by-step instructions to reproduce it, with any proof-of-concept code or screenshots;
- your contact details, and whether you would like public credit.
Please do not include real personal data or PHI in your report.
5. What to expect from us
| Step | Target |
|---|---|
| Acknowledge your report | 3 business days |
| Initial assessment and severity rating | 10 business days |
| Fix, based on severity (MED-POL-14 §4.4) | Critical 7 days; High 30 days; Medium 90 days; Low 180 days |
| Update you on progress | At least every 30 days until resolved |
If a report shows that customer data or PHI may have been exposed, we handle it as a security incident under our incident response plan (MED-POL-17) and notify affected customers as our contracts require.
6. Coordinated disclosure
Please give us a reasonable chance to fix the issue before you disclose it publicly. We ask for 90 days from your report, or until the fix is released if that comes sooner. We will agree a disclosure date with you.
7. Safe harbor
When you follow this policy in good faith, we consider your research authorized. We will not bring legal action against you, or ask law enforcement to investigate you, for that research. If a third party brings legal action against you for activity that complied with this policy, we will make it known that your actions were authorized by Mediaura. This safe harbor does not cover activity that breaks the rules in section 3 or the law.
8. Internal handling
Reports to security@mediaura.com are routed to the ISO (MED-POL-01 §4.2.5). Valid reports are tracked as vulnerabilities under MED-POL-14 and closed only after the fix is verified.