Book a call

DRAFT — not reviewed by a lawyer. Do not publish until a Texas attorney approves.

Haltr Vulnerability Disclosure Policy

Effective date: {{EFFECTIVE_DATE}}

We want to hear about security problems in Haltr's systems. If you find one and report it under this policy, we will work with you and we will not take legal action against you.

How to report

  • Email **{{SECURITY_EMAIL}}** ([email protected]).
  • Tell us what you found, where, how to reproduce it, and what an attacker could do with it.
  • Please do not include real personal data in your report. If you saw some, tell us what kind, not the data itself.

What we'll do

  • Confirm we got your report within 3 business days.
  • Tell you whether we can reproduce it, and our plan, within 10 business days.
  • Keep you updated until it's fixed, and tell you when it is.
  • Thank you publicly on our acknowledgments page if you want (we do not pay cash rewards at this time).

In scope

  • haltr.co and its subdomains run by Haltr.

Out of scope

  • Systems we don't run: Google, Cloudflare, Anthropic, phone providers, or our clients' own systems and websites. Report those to their owners.
  • Reports from automated scanners with no proof of real impact; missing best-practice headers with no exploit; clickjacking on pages with no sensitive action; self-XSS; rate-limit or spam issues on forms without a security impact.

Rules ("safe harbor")

If you follow these rules, we will consider your research authorized, we will not sue you or ask law enforcement to act against you for it, and if someone else does, we will say you acted under this policy:

  • Only test accounts and data you own or that we gave you. Never access, change, download or delete other people's data. If you reach any personal or client data by accident, stop, don't keep it, and tell us.
  • No denial-of-service, spam, social engineering (phishing our staff or clients), or physical attacks.
  • Don't use what you find for anything other than confirming and reporting it.
  • Give us 90 days to fix the issue before you share it publicly, unless we agree on another date.
  • Don't break the law.

This policy does not authorize testing of other companies' systems, and we cannot waive their rights.

Contact

{{SECURITY_EMAIL}} · Policy: https://haltr.co/security/disclosure · security.txt: https://haltr.co/.well-known/security.txt