Responsible disclosure

Our pledge

We welcome responsible-disclosure reports. If you find a vulnerability in HiringCoachAI, please let us know through the channels below. We commit to:

• Not pursue legal action against researchers who act in good faith under this policy.
• Acknowledge receipt: target within 2 business days.
• Triage: target within 5 business days.
• Keep you updated on remediation progress.
• Publicly credit you in our changelog, if you'd like.

Contact

• Email: [email protected].
• No bug bounty at this time; we are working on establishing one. In the interim we can offer public acknowledgment and thanks.

Scope

In scope

• hiringcoach.ai and www.hiringcoach.ai
• Our public API endpoints

Out of scope

• Denial-of-service (DoS / DDoS) attacks
• Social engineering of HiringCoachAI staff, customers, or vendors
• Physical attacks
• Attacks requiring MITM or compromised devices
• Findings from automated scanners without a demonstrable vulnerability
• Best-practice reports that are not exploitable (e.g., missing security headers on a static asset)
• Third-party services we use (report those to the vendor directly; we're happy to help if you get stuck)
• Self-XSS, or issues that require a non-standard browser configuration
• Rate-limit bypass without demonstrable impact
• Clickjacking on pages without sensitive actions

Please

• Act in good faith. Don't access data beyond what's needed to prove the issue.
• Don't modify, destroy, or exfiltrate data that isn't yours.
• Don't publicly disclose the issue before we've had a reasonable chance to fix it. We aim for 90 days; longer by mutual agreement.
• Give us enough detail to reproduce: URL, HTTP request, screenshots, expected vs. actual.

What we'll do

1. Acknowledge your report — target within 2 business days (see acknowledgment-target qualifier above). 2. Triage and assign severity using CVSS v3.1. 3. Keep you updated (typically weekly until resolved). 4. Remediation targets:

• Critical: 24 hours
• High: 7 days
• Medium: 30 days
• Low: best effort

5. Credit you (if you like) in the release notes.

Where a remediation target cannot be met — for example, because a vendor-side fix is not yet available — we apply compensating controls and keep the reporter updated.

Safe harbor

We consider security research conducted under this policy to be:

• Authorized access under computer-misuse laws;
• Exempt from anti-circumvention provisions where they would otherwise apply;
• Lawful and helpful to our security posture.

If legal action is initiated by a third party against you for activities that complied with this policy, we'll make it clear that your actions were authorized.

.well-known/security.txt

Contact: mailto:[email protected]
Expires: 2027-04-24T00:00:00.000Z
Preferred-Languages: en
Canonical: https://hiringcoach.ai/.well-known/security.txt
Policy: https://hiringcoach.ai/responsible-disclosure
Acknowledgments: https://hiringcoach.ai/responsible-disclosure#acknowledgments

Acknowledgments

Researchers who have helped us improve security will be listed here (with their consent) once reports begin coming in.

Related

• security overview: public security overview
• incident response
• breach notification