Last updated 2 November 2026
Found a security problem? Tell us.
If you have found a way to see or change something you should not, we want to hear it before anyone else does.
How to report
Write to the address below with “Security” in the subject.
- What you found, and where — the page, the endpoint or the screen.
- The steps to see it again, and what someone could do with it.
- How to reach you, if you want an answer.
What we promise
Report in good faith and within the rules below, and we will treat you as a help, not a threat.
- We acknowledge your report within 5 business days.
- We tell you when it is fixed, and name you if you want to be named.
- We will not take legal action over research done in good faith and within these rules.
Out of bounds
Good faith has limits, and these are ours.
- Do not access, change or keep anyone else's data beyond the minimum needed to show the problem.
- No denial of service, no spam, no social engineering of our staff, shops or members, no physical attempts.
- Do not use what you find to take value, and do not make it public before it is fixed.
Where this applies
bounou.tn and its subdomains — the console and the API — and the Bounou and Bounou Pro apps.
- Services we do not run ourselves are out of scope; report those to their owners.
- There is no reward programme yet. Every report is still read, and thanked.
Security contact · [email protected]
The same contact is published at /.well-known/security.txt.