Vulnerability Disclosure Policy

Security research guidelines

Security before shortcuts is a product value: deterministic knowledge domains, tenant isolation on the secured shared service all depend on defensible infrastructure. We welcome responsible disclosure so we can protect every deployment envelope. [Counsel: safe-harbor language and security.txt alignment.]

Please report issues in good faith so we can verify, remediate, and notify affected customers as appropriate.

1. In scope

• explico.dev and official Explico-operated authentication and portal surfaces;
• customer-shared SaaS infrastructure as defined in program updates;
• misconfigurations that materially affect confidentiality, integrity, or availability.

2. Out of scope

• Denial-of-service against production without prior written authorization;
• Social engineering of staff or customers;
• Physical attacks or third-party services outside our control;
• Customer-operated environments or lab prototypes not operated by Explico, except as coordinated with the customer’s security contact.

3. How to report

[Counsel: security@ email, PGP key optional, expected response times.]

4. Safe harbor

[Counsel: authorized research conditions and limitations.]

5. Recognition

We do not operate a public bug bounty program with guaranteed payouts. After we validate an in-scope report and deploy a fix (or ship an approved mitigation), we may, at our sole discretion, offer a thank-you gift such as a digital gift card through our fulfillment partner. Gifts are not promised for every report, are not cash equivalents, and may be declined for duplicate, out-of-scope, or abusive submissions. Eligible researchers may be invited to our internal security recognition process; amounts and timing are determined case by case.

Counsel review still required: align this section with safe harbor (§4), tax/1099 treatment, and security contact details before publication.