Security & Disclosure

• Encryption of data in transit (TLS) and at rest.
• Passwords stored only as salted, slow hashes; support for third-party authentication.
• Row-level database security so a query can only ever return data the caller is allowed to see, enforced and tested in CI.
• Least-privilege access for staff, audit logging, and a strict Content-Security-Policy on every page.
• Automated dependency and vulnerability scanning, and rate limiting on sensitive endpoints.
• Regular backups and a documented incident-response and breach-notification process.

Email foundbrew@gmail.com. Include a clear description, the steps to reproduce, the impact, and any proof-of-concept. Encrypt sensitive details if you can; request our PGP key in your first message.

We will acknowledge within 3 business days, keep you updated at least every 10 business days, and let you know when the issue is resolved. We do not currently run a paid bounty, but we credit reporters who want recognition.

If you make a good-faith effort to comply with this policy during your research, we will consider your research authorised, we will not pursue or support legal action against you, and we will help to the extent we can if a third party brings action.

To stay in scope, you must:

• only test against accounts you own or have explicit permission to test;
• avoid privacy violations, data destruction, and service degradation;
• not access or modify data beyond the minimum needed to demonstrate the issue, and delete any such data afterwards;
• give us reasonable time to remediate before any public disclosure, and coordinate that disclosure with us.

Out of scope: denial-of-service, social engineering of staff or members, physical attacks, spam, and findings from automated scanners without a demonstrated impact.

Acceptable Use Policy · Privacy Policy