Security Vulnerability Disclosure Policy

Reporting Channel

Please send reports to the dedicated security email. Include reproduction steps, impact scope, and proof-of-concept if available.

Our Process

1. Acknowledge receipt within 24 hours.
2. Complete initial triage and severity assessment within 3 business days.
3. Validate and reproduce the issue, then prioritize remediation based on impact.
4. Target remediation timelines: Critical within 7 days, High within 14 days, Medium within 30 days, Low within 90 days.
5. Coordinate disclosure with the reporter after a fix or mitigation is in place.
6. Notify affected users and publish a security advisory when required.

Safe Harbor

We will not pursue legal action against good-faith security research that follows this policy and avoids privacy violations or service disruption.