Vulnerability Disclosure Policy

If you research and report in good faith under this policy, we will:

• Treat your research as authorized under the Computer Fraud and Abuse Act, the Digital Millennium Copyright Act, and similar laws, and not bring legal action against you for it.
• Waive the parts of our Terms and Acceptable Use Policy that would forbid the research, for that research only.
• Not count an accidental, good-faith step past these rules against you, as long as you stop and tell us.
• Say publicly that you acted under this policy if anyone else questions it.

• vantagewfm.com and app.vantagewfm.com.
• Our server functions, including the public ones for email sign-up, calendar feeds, webhooks, and the assistant connector.
• Workspace isolation, roles, and permissions: anything that lets someone see or change another workspace’s data, or more than their role allows.
• File uploads and the links that serve them.

• Denial of service, load testing, or anything that slows the Service for others.
• Social engineering, phishing, or physical attacks on our staff or offices.
• Services run by others, such as Google Cloud or a connected app. Report those to that company.
• Findings with no security impact, such as missing headers on pages with no sensitive content, self-XSS, or scanner output without a working proof of concept.

• Use only workspaces and accounts you created yourself. The Free plan is enough for testing. Never touch another company’s workspace or data.
• Go only as far as you need to show the problem. If you reach someone else’s data, stop, do not keep or share it, and tell us.
• Do not change or delete data that is not yours, or leave anything behind.
• Do not ask for payment in exchange for a report. Doing so ends the safe harbor.

Email [email protected] with what you found, where, the steps to reproduce it, and what someone could do with it. A short video or screenshots help. Our contact details are also published at /.well-known/security.txt.

• Acknowledge your report within three (3) business days.
• Tell you how serious we think it is within seven (7) business days.
• Keep you updated at least every fourteen (14) days until it is fixed.
• Ask you to wait ninety (90) days, or until it is fixed if sooner, before you publish. If it is being exploited, we will move faster and may agree to a shorter wait.

We do not pay bounties. With your permission, we will thank you by name in the note for the fix and give you a written confirmation of your report.