Responsible disclosure
Last reviewed 2026-05-18
<h2>Our pledge</h2>
<p>We welcome responsible-disclosure reports. If you find a vulnerability in HiringCoachAI, please let us know through the channels below. We commit to:</p>
<ul><li><strong>Not pursue legal action</strong> against researchers who act in good faith under this policy.</li><li><strong>Acknowledge receipt</strong>: target within 2 business days.</li><li><strong>Triage</strong>: target within 5 business days.</li><li><strong>Keep you updated</strong> on remediation progress.</li><li><strong>Publicly credit</strong> you in our changelog, if you'd like.</li></ul>
<h2>Contact</h2>
<ul><li><strong>Email:</strong> <code>[email protected]</code>.</li><li><strong>No bug bounty</strong> at this time; we are working on establishing one. In the interim we can offer public acknowledgment and thanks.</li></ul>
<h2>Scope</h2>
<h3>In scope</h3>
<ul><li><code>hiringcoach.ai</code> and <code>www.hiringcoach.ai</code></li><li>Our public API endpoints</li></ul>
<h3>Out of scope</h3>
<ul><li>Denial-of-service (DoS / DDoS) attacks</li><li>Social engineering of HiringCoachAI staff, customers, or vendors</li><li>Physical attacks</li><li>Attacks requiring MITM or compromised devices</li><li>Findings from automated scanners without a demonstrable vulnerability</li><li>Best-practice reports that are not exploitable (e.g., missing security headers on a static asset)</li><li>Third-party services we use (report those to the vendor directly; we're happy to help if you get stuck)</li><li>Self-XSS, or issues that require a non-standard browser configuration</li><li>Rate-limit bypass without demonstrable impact</li><li>Clickjacking on pages without sensitive actions</li></ul>
<h2>Please</h2>
<ul><li><strong>Act in good faith.</strong> Don't access data beyond what's needed to prove the issue.</li><li><strong>Don't</strong> modify, destroy, or exfiltrate data that isn't yours.</li><li><strong>Don't</strong> publicly disclose the issue before we've had a reasonable chance to fix it. We aim for 90 days; longer by mutual agreement.</li><li><strong>Give us enough detail to reproduce:</strong> URL, HTTP request, screenshots, expected vs. actual.</li></ul>
<h2>What we'll do</h2>
<p>1. Acknowledge your report — target within 2 business days (see acknowledgment-target qualifier above). 2. Triage and assign severity using CVSS v3.1. 3. Keep you updated (typically weekly until resolved). 4. Remediation targets:</p>
<ul><li>Critical: 24 hours</li><li>High: 7 days</li><li>Medium: 30 days</li><li>Low: best effort</li></ul>
<p>5. Credit you (if you like) in the release notes.</p>
<p>Where a remediation target cannot be met — for example, because a vendor-side fix is not yet available — we apply compensating controls and keep the reporter updated.</p>
<h2>Safe harbor</h2>
<p>We consider security research conducted under this policy to be:</p>
<ul><li>Authorized access under computer-misuse laws;</li><li>Exempt from anti-circumvention provisions where they would otherwise apply;</li><li>Lawful and helpful to our security posture.</li></ul>
<p>If legal action is initiated by a third party against you for activities that complied with this policy, we'll make it clear that your actions were authorized.</p>
<h2><code>.well-known/security.txt</code></h2>
<pre><code>Contact: mailto:[email protected]
Expires: 2027-04-24T00:00:00.000Z
Preferred-Languages: en
Canonical: https://hiringcoach.ai/.well-known/security.txt
Policy: https://hiringcoach.ai/responsible-disclosure
Acknowledgments: https://hiringcoach.ai/responsible-disclosure#acknowledgments</code></pre>
<h2>Acknowledgments</h2>
<p>Researchers who have helped us improve security will be listed here (with their consent) once reports begin coming in.</p>
<h2>Related</h2>
<ul><li><a href="/trust/docs/security">security overview</a>: public security overview</li><li><a href="/trust/docs/incident-response">incident response</a></li><li><a href="/trust/docs/breach-notification">breach notification</a></li></ul>