Responsible disclosure of vulnerabilities

Last update: 10 September 2026
Version: 1.0
To whom it applies: Security investigators

In summary

We do not take legal action against those who investigate in good faith within this framework.
We acknowledge receipt in 2 working days and give an initial evaluation in 10.
We publish a thank you with your name if you authorize.
We do not demand indefinite silence: we agreed on a date of publication.

This summary guides the reading and does not replace the text of the document.

01Our commitment

If you investigate in good faith following this policy, we consider your authorized activity, we will not undertake or support legal actions against you, and we will work with you to understand and resolve the problem quickly.

Stage	Deadline
Acknowledgement	2 working days
Initial evaluation and classification	10 working days
Critical vulnerability correction	Target of 30 days
Correction of mean or low severity	Target 90 days
Coordinated publication	Agreed with you, by default within 90 days

02What is allowed and what is not

Try only against own or test accounts. Never against data from a real client.
Stop as soon as you confirm vulnerability. You don't need to extract data to prove that you can.
If you accidentally access third party data, stop the test, do not keep them and let us know immediately.
Do not degrade service: no denial of service, massive brute force, or deliberate saturation.
Do not use social engineering against our staff, our customers or their drivers.
You do not physically access devices installed in third-party vehicles.
Do not publish the details before the date we agree.

03How to report

Email [email protected]. If you prefer to cipher, we publish our public key in / .well-known / security.txt. includes description, reproducible steps, estimated impact and - if you have it - a minimum concept test.

Today we do not have a program of economic rewards. We do publish a thanks with your name or pseudonym, if you authorize it, and we accompany you in the coordinated publication. We prefer to say it clearly rather than leave the expectation open.

Status of this document

Text prepared by Drometra and pending review by external legal advice before its final publication. Its structure and content were built on the current Chilean legislation and on Law 21.719, which has been in force since 1 December 2026. It does not constitute legal advice for third parties.