Vulnerability Disclosure Policy
We take reports of security issues seriously. This page explains what to report, the scope, and the safe-harbor terms for researchers who contact us in good faith.
Scope
We welcome reports about security vulnerabilities in the Impact Alignment Hub application, including the consultant app, the public review portal at /review/:token, and the license-activation flow. The public review portal intentionally uses an open access model gated by link tokens and one-time codes; see our threat model for accepted risks. Reports that extend the known limitations or surface new attack paths are especially valuable.
Out of scope
- Denial-of-service, volumetric flooding, or automated load testing against the service.
- Spam, social engineering, or physical attacks against staff or users.
- Discovering exposed review links by guessing tokens where no real-world user is affected — the token+code design is documented as a known trade-off.
- Reports from automated scanners without a demonstrated, reproducible impact.
Safe harbor
We will not pursue legal action against researchers who follow this policy, act in good faith, avoid harming users or data, and give us reasonable time to respond before public disclosure. In return, we ask that you do not access or modify data that is not yours, and that you report privately first.
How to report
Use the form below. Reports are stored securely and reviewed by our admin team. Including an optional contact email lets us follow up for clarification; you may report anonymously.
