Security vulnerability disclosure
English is the authoritative version for D14. A fuller Romanian translation may follow after human review.
Scope
This policy covers security issues in Mia-operated services: the mia.store marketing site, creator dashboard, checkout and API, official subdomains (including status.mia.store), and infrastructure we control. Out of scope: attempting to compromise another creator’s storefront, social engineering of Mia staff or creators, physical attacks, and third-party services (Stripe, etc.) except where Mia’s integration is clearly at fault.
Safe harbour
If you make a good-faith effort to comply with this policy — including giving us reasonable time to fix the issue before public disclosure — we will not pursue legal action against you for the research. We cannot speak for third parties. Do not access, modify, or exfiltrate data that is not yours.
Rules of engagement
Use test accounts where possible. Do not degrade service for others (no denial of service). Do not spam automated scanners against production without prior written approval. Include enough detail for us to reproduce the issue.
How to report
Email security@mia.store with a description, steps to reproduce, impact assessment, and optional proof-of-concept. Encrypt sensitive details if you can. We may ask for more information. We aim to acknowledge reports promptly and will keep you updated on material progress.
Recognition and bounty
We thank researchers who help us improve Mia. We do not operate a paid bug bounty at launch; we may credit you with permission after a fix ships.
Security contact
Machine-readable file: /.well-known/security.txt