PermitCore Responsible Disclosure Policy ========================================= Last updated: 2026-06-22 Scope ----- All services under permitcore.dev and api.permitcore.dev, including the REST API, admin panel, public website, and associated infrastructure. Out of scope ------------ - Denial-of-service attacks - Social engineering or phishing against PermitCore staff - Attacks requiring physical access to infrastructure - Findings in third-party services we depend on (report to them directly) What to report -------------- - Authentication or authorization bypasses - Injection vulnerabilities (SQL, command, template) - Sensitive data exposure - Cryptographic weaknesses - Insecure direct object references (IDOR) - Cross-tenant data leakage - Security misconfigurations with real-world impact Responsible disclosure guidelines ---------------------------------- 1. Do not access, modify, or delete data that does not belong to your test account. 2. Do not disrupt service availability for other users. 3. Report findings to security@permitcore.dev. PGP encryption is not yet available (see PGP Key section below) — for a highly sensitive finding (e.g. an auth bypass), email us first to request a secure channel before sending details. 4. Allow us up to 90 days to resolve confirmed issues before public disclosure. We will proactively communicate status and request extensions only when necessary. 5. We will acknowledge your report within 48 hours. Response SLA by severity ------------------------ Critical (authentication bypass, RCE, cross-tenant data access): 7 days High (privilege escalation, sensitive data exposure): 30 days Medium (CSRF, limited data exposure, configuration issues): 90 days Low (informational, defense-in-depth improvements): best effort These are target remediation timelines from the point of confirming the issue, not from initial report receipt. CVE coordination ---------------- We support coordinated vulnerability disclosure. For vulnerabilities with ecosystem-wide impact (e.g. affecting the open-source PermitCore components or the public validation protocol), we may request a CVE identifier through a CNA and will coordinate disclosure timing with you. PGP Key ------- Not yet published. If you need to send a highly sensitive report (e.g. an authentication bypass or a working exploit) and want it encrypted first, email security@permitcore.dev to request a secure channel — we do not want an unpublished key advertised here that a researcher can't actually verify. Safe Harbor ----------- PermitCore considers security research conducted under this policy to be authorized and will not pursue legal action against researchers who: - Act in good faith and follow this policy - Avoid privacy violations, service disruption, and data destruction - Do not exploit vulnerabilities beyond what is necessary to demonstrate the issue - Report findings promptly and allow reasonable time for remediation We will work with you to understand and resolve the issue quickly and will acknowledge your contribution in our release notes (unless you prefer anonymity). Bug bounty ---------- We do not currently offer a paid bug bounty program. We acknowledge all confirmed findings in our release notes and credit researchers by name or anonymously, per their preference.