Security at RentOk

Report a vulnerability

Email security@eazyapp.tech. This mailbox is monitored by our engineering team. Please include:

• The affected URL, endpoint, or app screen.
• Steps to reproduce, ideally as a request we can replay.
• What an attacker could do with it.
• How you would like to be credited, if the report is valid.

What we commit to

We do not currently run a paid bounty programme, but we do reward reports that find real impact, and we will always offer public credit if you want it.

Safe harbour

If you make a good faith effort to follow the rules on this page, we will treat your research as authorised. We will not pursue legal action against you or ask others to, and if a third party brings a claim about work that stayed within this policy, we will make it clear that we authorised it. If you are unsure whether something is in scope, ask us first at security@eazyapp.tech and we will answer before you test.

Rules of engagement

• Use only accounts you own or have explicit permission to test.
• Stop as soon as you have confirmed a vulnerability. Do not pivot further into our systems.
• Access the minimum data needed to prove the issue. If you encounter personal data belonging to someone else, stop, do not save it, and tell us what you saw.
• Do not modify or delete data that is not yours, and do not run write operations against production.
• Do not publish or share your findings until we confirm the issue is fixed.

Scope

In scope

• rentok.com and its subdomains
• eazypg.in and its subdomains
• The RentOk owner and manager web apps
• The RentOk owner and tenant mobile apps

Out of scope

• Denial of service, load testing, and anything that degrades service for our customers
• Social engineering or phishing of our staff, customers, or vendors
• Physical attacks against our offices or staff
• Findings from automated scanners with no demonstrated impact
• Missing security headers, cookie flags, or TLS configuration with no working exploit
• Reports about software we do not operate, including third party services we merely link to

Acknowledgements

Our thanks to the researchers below, who reported issues to us responsibly and gave us the time to fix them.