Report a vulnerability
Email support@evokoa.com with the subject ‘Security disclosure’. Include the affected FlashDrive URL or client version, the date and time of the issue, its potential impact, and the minimum steps needed to reproduce it. Use your own test accounts and sample files for evidence. Redact credentials, access tokens, file contents and personal data. Ask us for a suitable transfer method before sending sensitive evidence.
Explain the actual security impact. An unverified scanner result, software version, missing header or generic checklist alone may not establish a vulnerability. Do not run additional scans or access someone else’s data to strengthen a report. If you cannot safely verify an issue, describe what you observed and stop.
Scope
This policy covers FlashDrive, the file storage and collaboration service for people and their agents, operated by Evokoa. It applies to our public website, account console, file and search APIs, agent connections through MCP, and official clients, only where Evokoa controls the affected system or software.
Use only accounts, organizations, workspaces and files you own or have explicit permission to test. To examine an access-control issue, use separate test accounts and data you control. A public URL, shared link or working credential is not permission to test another person’s resources.
Third-party agents, providers, customer deployments and underlying hosting infrastructure are outside this policy. Other Evokoa products, private infrastructure and unlisted or unreleased services are not included. If ownership or scope is unclear, obtain our written authorization before testing.
Keep research safe
Use only targeted, manual checks and the minimum requests needed to demonstrate a specific issue safely. Stop once you have enough evidence. Keep changes confined to your own disposable test data, and never affect other customers or the availability of the service.
Do not access, download, modify, delete or enumerate other people’s files, search results, accounts, workspaces or credentials. Do not use leaked or stolen credentials. Do not install persistence, move into other systems, execute commands on our infrastructure, or extract data at scale.
If unexpected access exposes someone else’s data, stop immediately. Report the affected endpoint and what happened without copying, retaining or sharing the exposed information. Do not continue to find out how much data is accessible.
Scanning and disruptive testing
Automated vulnerability scans, broad endpoint or directory discovery, fuzzing, bulk enumeration and automated exploitation require our written authorization before you start. This includes testing run by scripts, bots, security tools or autonomous agents. Ask us to agree on the targets, methods, request limits and testing window. Silence, an account subscription or submission of a report is not approval.
This policy does not permit denial-of-service or load testing, resource exhaustion, brute-force login attempts, credential stuffing, password spraying, spam, phishing, social engineering or extortion. Do not flood file operations, searches, invitations or authentication flows, create accounts to evade limits, or trigger costs and notifications for other users.
Respect rate limits, access denials and requests to stop. Do not rotate IP addresses, identities or accounts to bypass a block or other protective control. We may block traffic, revoke access or suspend accounts to protect the service. Security testing does not exempt activity from these controls.
Coordinate disclosure
Report issues promptly and give us a reasonable opportunity to investigate and address them before sharing exploit details publicly. We will review reports, seek clarification when needed, and work with you on remediation and disclosure timing. Resolution depends on impact and complexity; this policy does not promise a fixed response or remediation deadline. There is no guaranteed payment or bounty.
Good-faith research
Evokoa authorizes only the limited security testing expressly permitted by this policy. To qualify, your activity must be conducted in good faith for the purpose of identifying and responsibly reporting a security vulnerability, remain within the stated scope, use the minimum testing necessary, and comply with the safeguards and disclosure requirements above. For activity that meets these conditions, Evokoa will not initiate legal action against you under rights or claims we control. This commitment covers only that qualifying activity, not unrelated or prohibited conduct.
Submitting a vulnerability report, describing activity as research, or offering to disclose a vulnerability does not create authorization or excuse prohibited conduct. This commitment does not cover unauthorized scanning, access to other customers’ accounts or data, data theft, extortion, service disruption, or exploitation beyond the minimum safe demonstration. Any exception to our terms is limited to the testing expressly permitted by this policy. All other restrictions remain in effect.
If you encounter other people’s data or uncertainty about scope, stop testing and contact support@evokoa.com. We may require you to pause or stop specific testing to protect users or systems. If we do, stop immediately and do not resume without our written authorization. A later request to stop or policy revision does not withdraw this commitment for earlier activity that complied with the policy then in effect. Conduct outside the policy remains subject to applicable law and our terms, and we reserve our rights concerning that conduct.
This policy concerns only permissions and claims Evokoa controls. It does not authorize testing of third-party systems, bind third parties or authorities, or provide immunity from applicable law. If an activity is not clearly permitted, obtain our written authorization before proceeding.
Handling your report
We use report details to investigate, communicate with you, and address the issue. Share only information necessary for that work. We may involve service providers or affected parties when needed to resolve the report, subject to applicable privacy obligations. For questions about a report, contact support@evokoa.com.