Security and vulnerability disclosure

Updated 19 October 2026. This policy covers clargus.com and its beta waitlist forms. It is also linked from our security.txt file.

How to report

Email security@clargus.com with the affected page or address, the steps to reproduce the issue, and what an attacker could achieve. Please do not include other people's personal data in your report. We aim to acknowledge reports within five business days.

In scope

The clargus.com website, its forms and its public API endpoints under /api/public/.

Out of scope

Denial of service and load testing, social engineering of our staff or providers, physical attacks, spam, reports from automated scanners without a demonstrated impact, missing best-practice headers without an exploit, and services run by third parties such as Cloudflare, Supabase, Google and Microsoft. Report issues in those services to the provider.

Good-faith research

If you act in good faith, stay in scope, avoid privacy violations and service disruption, access only the data needed to demonstrate the issue, and give us reasonable time to fix it before any disclosure, we will not pursue legal action against you for that research. This does not authorize testing systems we do not own.

Rewards

We do not run a paid bug bounty program at this time. We are glad to credit researchers who report valid issues, with their permission.