Vulnerability Disclosure Policy

Introduction

We take the security of our platform and our customers' data seriously. We value the work of security researchers and welcome reports that help us keep the platform safe. This policy explains what you can test, how to report a vulnerability, and what you can expect from us in return. It is written to align with coordinated vulnerability disclosure best practices, including CISA guidance and ISO/IEC 29147 and 30111.

Scope

This policy applies to the services we operate on our primary domains, including:

• Our public website and marketing pages
• The customer dashboard
• Our public APIs and documented integration endpoints

If you are unsure whether a target is in scope, contact us before testing and we will clarify.

Authorization and Safe Harbor

We authorize good-faith security research conducted in line with this policy. If you make a good-faith effort to comply with this policy during your research, we will consider your research to be authorized, we will work with you to understand and resolve the issue quickly, and we do not intend to pursue or support legal action against you for research carried out in accordance with this policy. This is a statement of intent and not a waiver of any rights or a binding legal commitment.

If legal action is initiated by a third party against you for activity that was conducted in accordance with this policy, we will take steps to make it known that your actions were conducted in compliance with this policy. This authorization does not apply to actions that intentionally harm users, degrade our services, or access data beyond what is necessary to demonstrate a vulnerability.

Guidelines for Researchers

To keep your research authorized under this policy, please:

• Report any vulnerability you discover promptly, and give us a reasonable time to respond before public disclosure.
• Avoid privacy violations, data destruction, and interruption or degradation of our services.
• Access only the minimum amount of data needed to demonstrate the issue. If you encounter personal data, stop and report it.
• Do not use social engineering, phishing, or physical attacks against our staff, users, or facilities.
• Do not run automated scans that could degrade availability. Use rate-limited, targeted testing.
• Keep the details of any vulnerability confidential while we work on a fix. If we have not agreed on a disclosure timeline with you, please allow up to 90 days from your report before disclosing publicly.

How to Report a Vulnerability

Send your report to security@opportify.ai. For sensitive reports, encrypt your message with the PGP key published in our security.txt file. A strong report includes:

• A clear description of the vulnerability and its impact
• Step-by-step instructions to reproduce it, including affected URLs or endpoints
• Any proof-of-concept code, requests, or screenshots

We aim to acknowledge valid reports within five business days, keep you informed as we investigate, and let you know when the issue is resolved. These are target response times, not a contractual service-level commitment.

Coordinated Disclosure

We support coordinated disclosure. We ask that you give us a reasonable period to investigate and remediate before any public disclosure, up to 90 days from your report unless we agree on a different timeline with you. When a report leads to a fix, and if you would like to be acknowledged, we will credit you by the name or handle you provide once the issue is resolved.

Out of Scope

The following are generally not eligible under this policy unless you can demonstrate a concrete security impact:

• Reports from automated scanners without a working proof-of-concept
• Missing security headers or best-practice suggestions with no demonstrated exploit
• Denial-of-service, volumetric, or spam-based testing
• Social engineering, phishing, or physical access attempts
• Vulnerabilities in third-party services we do not control