Responsible Disclosure Policy

How to report

Email support@simpleverifier.com with the subject “Security report”. Include the affected URL or endpoint, the steps to reproduce, what you were able to access, and your name or handle if you want credit. Our security.txt carries the same contact.

In scope

• simpleverifier.com and its server functions
• api.simpleverifier.com (the verification API), the public API at /api/v1 and the MCP server at /api/mcp
• The Chrome extension and the Google Sheets add-on that we publish

Out of scope

• Third-party services we use (Stripe, Vercel, Supabase, Google, PostHog, Telnyx). Report those to the provider.
• Denial of service, volumetric load tests and anything that sends large amounts of traffic.
• Social engineering of our team or customers, and physical attacks.
• Findings that need a rooted device or a browser the attacker already controls.
• Missing best-practice headers or settings with no demonstrated impact, and automated scanner output with no proof.
• Spam-filter, mail-server or blocklist opinions about our verification host. Those are not vulnerabilities.

What we ask

• Test only with accounts you own. Do not access, change or keep other customers’ data. If you reach any, stop and tell us.
• Do not run tests that degrade the service for others, and do not send test traffic through our verification server to third-party mail servers at volume.
• Give us reasonable time to fix the problem before you publish details.
• Do not extort, threaten or demand payment.

What you can expect

• We aim to acknowledge a report within 3 business days and to tell you what we found after we have looked at it.
• We will not start legal action against, or ask others to act against, someone who followed this policy in good faith.
• We will credit you on request when the fix ships.
• We do not run a bug bounty and cannot offer payment. We can offer thanks and credit.

This policy covers reports about SimpleVerifier. It is not a legal safe harbour for activity that breaks the law. See also security and data handling and the terms of service.