Vulnerability disclosure policy

1. How to submit a report

Please email vulnerability reports directly to security@example.com. To help us triage and reproduce your finding rapidly, please include:

• a clear technical description of the vulnerability and its potential security impact;
• step-by-step instructions to reproduce the issue, including any proof-of-concept (PoC) code, HTTP requests/responses, or screenshots/videos;
• the specific URL, API endpoint, or component affected (e.g., web application, Chrome/Edge browser extension, Slack/Teams bot, Website Import tool, Trust Center, or Share Links); and
• how you would like to be acknowledged (if at all) once the issue is resolved.

2. What you can expect from us

When you submit a report in compliance with this VDP:

• We will acknowledge receipt of your report within three (3) business days.
• We will validate the issue, assess its severity, keep you reasonably informed of our remediation progress, and notify you when the fix has been deployed.
• We will treat your report and your personal identity confidentially and will not disclose your details to third parties without your permission (except where required by law).
• With your consent, we are happy to publicly credit your contribution after the vulnerability has been remediated. (Please note that we operate a vulnerability disclosure program and do not currently offer monetary bug bounty payouts.)

3. Rules of engagement (mandatory testing rules)

To qualify for safe harbor under Section 5, your security research must strictly adhere to all of the following rules:

• Test Only Against Your Own Test Workspace: Conduct all testing exclusively against Free Plan organization account(s) that you created yourself and populated solely with fictional, non-sensitive test data. If testing cross-tenant isolation, test solely between two test organizations that you personally created and control.
• Zero Access to Other Customers’ Data: Never attempt to access, view, modify, exfiltrate, or delete data belonging to any actual customer or third-party organization. If you inadvertently encounter any data that does not belong to your own test account, you must immediately halt testing, purge any local copies of that data, do not share or disclose it to anyone, and report the finding immediately to security@example.com.
• No Service Degradation or DoS: Do not perform any testing that could degrade, disrupt, or impair the availability or performance of the Service, including Denial-of-Service (DoS/DDoS) attacks, volumetric load testing, resource exhaustion of AI drafting endpoints, spam, or unthrottled automated vulnerability scanners.
• No Social Engineering or Physical Attacks: Do not conduct phishing, vishing, social engineering, credential stuffing, or physical attacks against AcuityRFP employees, customers, or service providers.
• No Third-Party Infrastructure Testing: Do not test third-party services or Subprocessors that we integrate with or rely upon (such as Stripe, Slack, Microsoft, Google, or cloud hosting providers); report vulnerabilities in third-party software directly to the respective vendor’s security program.
• Coordinated Disclosure: Do not publicly disclose, blog about, or share details of any suspected vulnerability with any third party until we have confirmed that the issue is fully remediated and we have mutually agreed in writing on a coordinated disclosure date.

4. Out-of-scope findings

The following issue types are excluded from the scope of this VDP and will generally not be accepted:

• Unverified output from automated scanners without a working, demonstrable proof-of-concept exploit showing real security impact;
• Missing or theoretical best-practice HTTP headers, TLS cipher configurations, or DNS records (such as SPF/DKIM/DMARC nuances) without a practical exploit vector;
• Rate-limiting behaviors on non-sensitive endpoints, or enumeration of public information;
• Self-XSS, clickjacking on pages without sensitive state-changing actions, or attacks requiring physical access to a victim’s unlocked device or browser profile;
• Vulnerabilities affecting end-of-life or unpatched browsers/operating systems; or
• Content published intentionally by a customer on their own public Trust Center or via a valid Share Link URL.

5. Legal safe harbor

If you conduct security research and report vulnerabilities to us in good-faith compliance with all requirements of this VDP:

• AcuityRFP considers your security research to be authorized under applicable anti-hacking and computer misuse laws (including the U.S. Computer Fraud and Abuse Act (CFAA), 18 U.S.C. § 1030, and equivalent international laws) and waives any restriction in our Acceptable Use Policy or Terms of Service that would otherwise prohibit your compliant testing;
• AcuityRFP will not initiate, support, or refer any civil lawsuit or criminal law-enforcement investigation against you for your compliant research under this VDP, including any claim under the Digital Millennium Copyright Act (DMCA) for good-faith circumvention of technological measures during authorized testing; and
• If a third party initiates legal action against you for security research conducted strictly in compliance with this VDP against systems owned by AcuityRFP, we will take steps to make known to the court or relevant authorities that your activities were conducted with our authorization pursuant to this policy.

Limitation of Safe Harbor: Please note that AcuityRFP can only authorize testing against systems and data that we own or control; this safe harbor does not authorize testing against third-party infrastructure, nor does it protect you if you access, retain, or disclose another customer’s data or fail to abide by the Rules of Engagement in Section 3. If you are ever unsure whether a planned test is within scope, please contact security@example.com before conducting the test.