Draft for legal review before production launch. This template is a starting point, not legal advice.
Security & Vulnerability Disclosure
How to report a vulnerability, and what we promise in return.
Reporting
Email support@example.com with the affected URL, what you did, and what happened. Please do not open a public issue. A machine-readable version of this policy is at /.well-known/security.txt.
What we promise
We will acknowledge within 3 working days, keep you updated, credit you if you want, and not pursue legal action for good-faith research that follows the rules below.
Rules for good-faith research
Do not access, modify or delete data belonging to anyone else. Use your own accounts and test battles.
No denial of service, no spam, no social engineering of our staff or users, no physical attacks.
Give us a reasonable window to fix an issue before disclosing it publicly.
Out of scope
Missing security headers with no demonstrated impact, rate limits on non-sensitive endpoints, reports from automated scanners without a working proof of concept, and issues in third-party services we do not control.