1. Purpose

This policy provides guidelines for security researchers to report vulnerabilities responsibly.

2. Reporting

If you identify a security issue, report it to us. Include:

• Description of the vulnerability
• Steps to reproduce
• Impact assessment
• Your contact details

3. Rules of Engagement

Researchers must:

• Avoid accessing customer data
• Not disrupt services
• Not perform DDoS, spam, or destructive actions
• Give us reasonable time to fix issues before public disclosure

4. Our Commitment

We will:

• Acknowledge receipt promptly
• Investigate the issue
• Address vulnerabilities responsibly
• Credit researchers (if desired)

5. Safe Harbor