Vulnerability Disclosure Policy

• Email security@selfrunbusiness.com. Our security.txt file at /.well-known/security.txt lists the same contact.
• Describe what you found, where it is, how to reproduce it and the impact you expect. Screenshots or a short video help.
• Do not include other people's data. If you saw some, tell us the type and where, not the data itself.

• The product website and the workspace and product applications served from it.
• Our public APIs and the sign-in, billing and file-upload flows.
• The desktop and mobile apps we build.

• Denial-of-service, volumetric attacks, and spam or social engineering of our people or customers.
• Findings that need a rooted or jailbroken device, or physical access.
• Missing best-practice headers or settings with no demonstrated impact, and reports from automated scanners without a working proof.
• Attacks on providers we use (report those to the provider), and on a customer's own systems.

• Test only against accounts you own or have permission to use, and never touch another company's data.
• Do not degrade the service, run automated attacks at volume, or keep access longer than needed to show the issue.
• Do not publish details until we have fixed the issue or agreed a date with you.

• We acknowledge your report within three business days.
• We reproduce it, assess its severity and tell you what we found.
• We fix critical and high issues before the next release goes out and verify the fix.
• We tell you when it is fixed, and credit you if you wish.

If you follow this policy in good faith, we will treat your research as authorised, we will not pursue legal action against you for it, and we will say so if a third party brings a claim. This does not cover activity outside the policy, and it cannot bind other parties.

Security reports: security@selfrunbusiness.com.