Responsible Vulnerability Disclosure Policy

Get BOB values the security of our platform and appreciates the efforts of security researchers who help us identify and responsibly disclose vulnerabilities.

This policy explains how to report security issues, how we handle vulnerability reports, and what researchers can expect when participating in our Responsible Vulnerability Disclosure Program.

1. Our Program

Get BOB operates a responsible vulnerability disclosure program.

We welcome reports of legitimate security vulnerabilities that could affect the confidentiality, integrity, or availability of our systems or customer data.

We evaluate reports based on their demonstrated technical impact, reproducibility, exploitability, and practical risk. Hypothetical or speculative impacts, without evidence of the claimed security consequence, will generally not affect severity classification.

Participation in this program is voluntary and subject to the terms of this policy.

2. Recognition

Get BOB does not operate a public bug bounty program.

We sincerely appreciate responsible security research and carefully review all legitimate vulnerability reports. However, we generally do not provide monetary rewards or other compensation for reported vulnerabilities.

Submitting a report does not create any obligation for Get BOB to provide payment, employment, consulting opportunities, public recognition, or any other form of compensation.

From time to time, at our sole discretion, we may choose to acknowledge exceptional contributions in a non-financial manner. Such recognition is entirely voluntary and should not be expected.

Researchers who require guaranteed compensation or wish to provide paid security consulting services should obtain written authorization from Get BOB before conducting security testing.

3. What to Report

We are interested in vulnerabilities that could have a meaningful security impact, including:

  • Authentication or authorization bypass
  • Privilege escalation
  • Remote code execution
  • SQL injection or command injection
  • Cross-site scripting (XSS)
  • Cross-site request forgery (CSRF)
  • Sensitive data exposure
  • Significant business logic flaws
  • Other vulnerabilities with a demonstrable and reproducible impact on the security of our platform or customer data

Reports should include sufficient evidence to reproduce the issue and demonstrate the actual security impact observed.

Severity is determined by the demonstrated impact of the reported issue, not solely by CVSS scores, CWE classifications, theoretical attack chains, or hypothetical downstream consequences.

4. Out of Scope

The following issues generally fall outside the scope of this program and may not receive an individual response:

  • Missing or recommended HTTP security headers
  • Clickjacking without a demonstrated exploit
  • Missing SPF, DKIM, or DMARC records
  • SSL/TLS configuration recommendations without exploitable impact
  • Version disclosure or banner grabbing
  • Rate-limiting suggestions without demonstrated abuse
  • Information disclosed through publicly available sources
  • Best-practice recommendations
  • Self-XSS
  • Reports requiring unrealistic user interaction
  • Social engineering
  • Physical security issues
  • Denial-of-service or resource exhaustion testing
  • Third-party vulnerabilities outside Get BOB’s control
  • Issues already known to Get BOB
  • Duplicate reports
  • Reports generated primarily through automated scanners or AI tools without meaningful manual validation or a demonstrated security impact

5. Rules of Engagement

When testing our systems, you agree to:

  • Act in good faith.
  • Avoid accessing, modifying, deleting, or retaining customer data.
  • Avoid disrupting our services or degrading their availability.
  • Stop testing once sufficient evidence has been obtained.
  • Report vulnerabilities promptly.
  • Keep vulnerability details confidential until Get BOB has had a reasonable opportunity to remediate the issue or we have agreed upon a public disclosure timeline.
  • Comply with all applicable laws and regulations.

6. Safe Harbor

If you conduct security research in good faith and in accordance with this policy, Get BOB will not pursue legal action against you solely for activities that comply with this policy.

This safe harbor applies only to activities that comply with this policy and applicable law.

Nothing in this policy authorizes access to data that does not belong to you, disruption of our services, or any activity that exceeds the scope of responsible security research.

7. Response Process

While response times vary, we generally aim to:

  • Acknowledge receipt of reports within several business days.
  • Independently validate reported vulnerabilities and assess their demonstrated impact and severity.
  • Prioritize remediation based on risk and impact.
  • Provide updates when practical.

Due to the volume of reports and our available resources, we cannot guarantee detailed responses, timelines, or status updates for every submission.

8. Public Disclosure

Please do not publicly disclose vulnerability details until Get BOB has confirmed that the issue has been remediated or we have mutually agreed upon a disclosure timeline.

Failure to comply with this policy may result in future reports receiving lower priority or being declined.

9. Contact

Security reports may only be submitted through our dedicated vulnerability disclosure form. Reports submitted through any other channel may not be processed.

Please include:

  • A clear description of the vulnerability
  • Steps to reproduce the issue
  • The affected URL, endpoint, or feature
  • An assessment of the demonstrated security impact
  • Proof of concept or supporting evidence, where applicable

Last updated: August 1, 2026

Responsible Vulnerability Disclosure Policy | Get BOB