Found a security concern? Report it safely.

This portal complements the Kool&Tech Vulnerability Disclosure Policy. The policy defines authorized good-faith research, scope, prohibited testing, confidentiality, safe harbor conditions, and coordinated disclosure expectations. This page explains how to submit and route a report.

Security reports may be submitted to info@koolandtech.com with a clear security-related subject. Do not send passwords, private keys, authentication tokens, complete payment-card data, or unnecessary Personal Data in the initial message.

For an active compromise, exposed credential, ongoing unauthorized access, malicious modification, or immediate risk to Customer operations, clearly mark the report as urgent and describe safe containment information without exploiting or expanding access.

Report suspected vulnerabilities in Kool&Tech-controlled websites, applications, APIs, authentication flows, integrations, configuration, source exposure, access controls, data isolation, secrets handling, or other systems expressly covered by the published Vulnerability Disclosure Policy.

Issues affecting Odoo, Microsoft, hosting providers, payment services, communications platforms, open-source projects, Customer-controlled systems, or other independent services should normally be reported to the responsible provider unless Kool&Tech-controlled configuration or integration is directly involved.

Confirm the affected asset, avoid unnecessary testing, preserve the original evidence, remove unrelated sensitive data, distinguish observation from assumption, and review the published scope and prohibited activities.

Evidence should be limited to what is necessary to demonstrate the issue. Redact secrets and unrelated Personal Data. Do not place sensitive evidence in public repositories, social media, shared links without access controls, or third-party paste services.

If sensitive follow-up material is necessary, request a secure exchange method before transmitting it. Publication of this portal does not represent that a PGP key or another encrypted reporting channel is currently available.

Testing must remain within the Vulnerability Disclosure Policy. Avoid privacy violations, service degradation, destruction or modification of data, persistence, lateral movement, social engineering, denial-of-service, credential attacks, physical testing, or accessing more data than necessary to confirm the issue.

Stop testing and report immediately after confirming a vulnerability, encountering sensitive information, gaining unintended access, observing another Customer data, triggering material service impact, or discovering a condition that could worsen through continued testing.

For an exposed key, token, password, certificate, connection string, or secret, provide the location and safe identifying details without reusing, validating, or publishing the credential. Kool&Tech may rotate or revoke the credential as a protective measure.

Do not download, copy, retain, share, or analyze Personal Data beyond what is strictly necessary to document the existence of exposure. Report the type of information observed and stop access immediately.

Kool&Tech may validate scope, reproduce safely, classify impact, identify affected services, preserve evidence, engage providers, apply containment, coordinate remediation, and request additional information. Submission does not confirm that a report is valid or in scope.

Prioritization may consider exploitability, affected data, privilege gained, affected Customers, scope, active exploitation, availability impact, reversibility, dependencies, existing mitigations, and evidence quality. This public portal does not promise a fixed severity label or remediation deadline.

Kool&Tech may acknowledge the report, request clarification, provide a case reference, communicate meaningful status changes, coordinate disclosure, or close the report. Communication depth depends on validity, risk, confidentiality, providers, and legal constraints.

Reports may be closed as duplicates, previously known issues, accepted risks, informational findings, unsupported claims, out-of-scope assets, or behavior operating as designed. Kool&Tech may limit details where disclosure could increase risk.

Reports should be accurate, reproducible, concise, and submitted in good faith. Automated scanner output without validation, unsupported claims, excessive duplicate submissions, or reports lacking an affected asset may not be actionable.

Do not publicly disclose vulnerability details, exploit code, sensitive evidence, or remediation status before Kool&Tech has had a reasonable opportunity to investigate and coordinate remediation under the Vulnerability Disclosure Policy.

Any authorization or safe-harbor commitment is limited to good-faith activity that complies with the published Vulnerability Disclosure Policy. This portal alone does not authorize testing beyond that policy.

Kool&Tech does not operate a public bug bounty through this portal unless a separate written program expressly states otherwise. Submission does not create a right to payment, reward, employment, contract, or public recognition.

Kool&Tech may recognize helpful reporters only with mutual approval and when recognition does not create security, privacy, contractual, or legal risk. Anonymous or confidential reporting preferences will be respected where practical.

Customers should use the authorized support or security contacts in the applicable agreement for suspected compromise, account takeover, service incident, or data exposure. Include the affected account or workspace but never send credentials.

Security and privacy notifications are evaluated according to verified facts, contractual roles, affected information, applicable law, provider involvement, and regulatory obligations. A report alone does not establish a reportable breach.

Kool&Tech may retain reports, communications, evidence, triage records, remediation notes, provider cases, and closure records for security, legal, operational, contractual, and improvement purposes under applicable retention controls.

Kool&Tech may publish a machine-readable security.txt file to advertise the reporting contact and policy location. The file should be reviewed and updated before its stated expiration.

A security.txt file or contact address makes reporting easier but does not independently authorize testing. Testing authorization continues to be governed by the Vulnerability Disclosure Policy.

Kool&Tech may restrict communications or escalate reports involving threats, extortion, deliberate harm, unlawful access, fraudulent claims, harassment, malicious attachments, or attempts to force payment or disclosure.

Kool&Tech may update this portal, reporting channels, scope references, templates, or secure-exchange methods as services and operational capabilities evolve. Reporters should consult the current published policy before testing.

Send security questions and responsible-disclosure reports to info@koolandtech.com with a clear subject. For ordinary technical support, billing, feature requests, or general inquiries, use the applicable non-security support channel.