Vulnerability Disclosure Policy

Email contact@bugmojo.com with a clear description of the issue, the affected URL or component, and step-by-step instructions to reproduce it. A proof-of-concept, request/response samples, and your assessment of impact all help us triage faster. Please report one issue per email.

We aim to acknowledge your report within approximately five business days, keep you updated as we investigate, and let you know when the issue is resolved. We appreciate good-faith research and are happy to credit reporters who wish to be acknowledged once a fix has shipped.

BugMojo does not currently run a paid bug-bounty program. Reports are handled on a responsible-disclosure basis, and there is no monetary reward.

We will not pursue or support legal action against researchers who make a good-faith effort to comply with this policy. We consider security research and vulnerability disclosure conducted under this policy to be authorized, and we will work with you to understand and resolve issues quickly. If a third party brings legal action against you for activity that complied with this policy, we will make it known that your actions were authorized.

To qualify for safe harbor, act in good faith, stay within the scope below, avoid privacy violations and service degradation, and give us a reasonable amount of time to remediate before any public disclosure.

In scope:

• The BugMojo web application and its public API.
• The BugMojo browser extension.
• The BugMojo public website and marketing pages.

Please avoid the following, which are out of scope and not authorized:

• Accessing, modifying, or deleting data that isn’t yours. Use test accounts and your own workspaces only.
• Denial-of-service, volumetric, or load testing; automated scanning that degrades the service.
• Social engineering, phishing, or physical attacks against BugMojo staff or users.
• Reports on third-party services and subprocessors we use. Report those to the vendor directly.
• Findings from automated tools without a demonstrated, exploitable impact (e.g. missing headers, best-practice-only reports).

Questions about this policy or a report in progress? Email contact@bugmojo.com.