Vulnerability disclosure
Report suspected vulnerabilities in ComplianceSafe systems, scanner workflows, tenant isolation, authentication, authorization, and data handling.
Scope
Report suspected vulnerabilities in ComplianceSafe web, API, scanner, worker, billing, reporting, authentication, authorization, tenant isolation, or data handling workflows.
Good-Faith Testing Boundary
We welcome reports from research that avoids privacy violations, service disruption, data destruction, social engineering, and physical attacks. This engineering guidance does not create a legal safe harbor; any such commitment requires approved legal terms.
Rules Of Engagement
Use only accounts, domains, projects, and scan targets you own or have explicit permission to test. Do not access, modify, retain, disclose, or exfiltrate customer data.
Reporting
Send a clear report with affected component, impact, reproduction steps, relevant logs or screenshots, and your preferred contact details.
Operational Response Goals
Our non-contractual operational goals are to acknowledge reports within three business days, provide an initial assessment within ten business days, and keep reporters informed until resolution.