Vulnerability disclosure

Email security@bcdrpulse.com with enough detail for us to reproduce and understand the issue.

• A clear description of the vulnerability and its potential impact.
• Step-by-step instructions to reproduce it, including the affected URL or area.
• Any proof-of-concept, logs, or screenshots that help.
• How we can reach you for follow-up.

• We'll acknowledge your report as quickly as we reasonably can.
• We'll keep you updated as we investigate and work on a fix.
• We'll let you know when the issue is resolved, and we're happy to credit you if you'd like.

If you make a good-faith effort to follow this policy, we will not pursue legal action against you for your research. Acting in good faith means giving us a reasonable chance to respond before disclosing the issue publicly, not accessing or modifying data that isn't yours, not degrading or disrupting our service, and not violating anyone's privacy.

This policy covers BCDRPulse's own website and application (bcdrpulse.com). The following are out of scope:

• Customer assets being tested through BCDRPulse — those belong to our customers, not us.
• Our third-party providers (such as Cloudflare, Clerk, and Dodo Payments) — please report issues in their systems directly to them.
• Findings that require physical access, social engineering, or denial-of-service / volumetric attacks.

• Run automated scanning that could degrade or disrupt the service.
• Access, modify, or delete data belonging to other users.
• Disclose the issue publicly before we've had a chance to address it.