If any questions regarding this policy, please email: [email protected]
We review security reports submitted in good faith and use them to improve the security of our products and services.
This policy is intended to support coordinated vulnerability disclosure. It is not a bug bounty contract and does not create an entitlement to payment, reward, or legal safe harbor beyond what is explicitly approved by Guideline Geo in writing.
Submit vulnerability reports through our security reporting form. Please include enough information for us to understand, reproduce, and assess the issue safely.
Do not include passwords, access tokens, private keys, unnecessary personal data, or exploit payloads that are not required for assessment.
This policy applies to products and services operated or distributed by Guideline Geo. Product-specific scope should be confirmed in the reporting form or accompanying product documentation.
Out of scope activities include social engineering, physical attacks, denial-of-service testing, spam, phishing, attacks against employees or customers, and testing of third-party systems that Guideline Geo does not operate.
When testing, avoid unnecessary access, modification, deletion, persistence, disruption, or exposure of data. Stop testing when you have enough evidence to demonstrate the issue and report it promptly.
If you encounter sensitive data, do not save, copy, disclose, or continue accessing it. Include only the minimum detail needed for us to investigate.
We triage reports based on severity, exploitability, affected products, and customer impact. We may contact you for clarification and may share remediation status when appropriate.
Our target response times are acknowledgement within 3 business days, initial triage within 10 business days, and status updates at reasonable intervals for confirmed issues.
Reports that indicate active exploitation or severe product-security impact may be escalated through our internal incident and regulatory reporting process.
We ask reporters to coordinate public disclosure with us until remediation or an agreed disclosure date. We review security reports regardless of whether coordinated disclosure is accepted.
Public advisories should avoid unnecessary technical detail before users have a practical fix, mitigation, or workaround.
We may credit reporters in security advisories when appropriate and when the reporter wants acknowledgement. We do not currently operate a bug bounty program or offer monetary rewards for vulnerability reports.
We process report information and reporter contact details for vulnerability triage, remediation, compliance, and security communications.
If any questions regarding this policy, please email: [email protected]
Newsletter
Sign up for Guideline Geo’s newsletter and be the first to know.