We welcome clear, good-faith reports that help protect event organizers, attendees, and the MeraEvents platform. Follow this policy so our team can investigate responsibly.
A concise, reproducible report helps us understand risk and reduces back-and-forth.
MeraEvents does not currently operate a public bug bounty program. Submitting a report does not create any entitlement to payment or other compensation. Eligible good-faith researchers may instead be recognized in our Security Hall of Fame, with their permission.
Responsible disclosure
These boundaries protect customers and researchers while we validate a report. Activity outside them may be treated as abuse.
Test only systems, accounts, and data you own or have explicit permission to use.
Stop immediately if you encounter personal data, credentials, payment data, or another person's private information. Do not download, retain, alter, or share it.
Do not use social engineering, phishing, physical attacks, denial of service, spam, or high-volume automated scanning.
Do not establish persistence, modify or delete data, disrupt service, or degrade another user's experience.
Report suspected vulnerabilities directly to MeraEvents. Do not contact organizers, attendees, partners, or other third parties about them.
Allow us reasonable time to investigate and remediate before any public disclosure. Do not use threats, coercion, or demands tied to disclosure.
Scope
MeraEvents-owned services on meraevents.com and api.meraevents.com, plus official MeraEvents mobile applications.
Organizer-owned external websites and third-party platforms or services, unless the issue is caused by how MeraEvents integrates with them.
Researcher recognition
We want to acknowledge researchers whose responsible disclosures materially improve the security of MeraEvents and our customers.
Recognition is discretionary, requires a valid policy-compliant report, and is published only after remediation and with the researcher's explicit consent. It is not a promise of payment or other compensation.
No researchers have been publicly listed yet. If you have found a vulnerability, follow the disclosure policy and email our engineering team directly.
Email to: developers@meraevents.comAfter you report
Our team will review the information, may ask for clarification, and prioritize remediation based on the risk to customers and the platform. We will share meaningful updates when practical.
Please keep technical details confidential while we investigate. You can follow up using the same email address or report thread so the evidence stays connected.
Email developers@meraevents.com with the relevant details. Please avoid including live secrets or unnecessary personal data.