Vulnerability Disclosure

If you act in good faith under this policy:

• We will not take legal action against you or report you to law enforcement for good-faith research that complies with this policy.
• We will work with you to understand and resolve the issue promptly.
• We will recognize your contribution if you would like to be credited, after the vulnerability is resolved.
• We will be transparent with you about progress, expected timelines, and the fix.

To stay within this policy:

• Make a good-faith effort to avoid privacy violations, destruction of data, and interruption or degradation of our Services.
• Only interact with accounts you own or have explicit permission from the account holder to test.
• Do not access, modify, or download data that does not belong to you. If you accidentally encounter such data, stop, do not copy or share it, and report it immediately.
• Do not exploit a vulnerability beyond the minimum needed to demonstrate it.
• Do not publicly disclose the vulnerability before it has been fixed and we have agreed on disclosure. Coordinated disclosure benefits everyone.
• Do not perform tests that could harm PracticPro, its customers, or third parties (no denial of service, no spam, no social engineering of our employees or customers, no physical attacks).
• Do not use automated scanners against our production systems without prior written authorization.

In scope

• practicpro.com - the marketing website.
• portal.practicpro.com - the authenticated PracticPro application.
• PracticPro mobile applications, where available.
• PracticPro's REST API and MCP server.

Out of scope

• Third-party services and sub-processors we use (Twilio, Telnyx, Stripe, OpenAI, Anthropic, Google, DigitalOcean, Cloudflare, etc.). Report vulnerabilities in those products to the provider directly.
• Findings from automated tools without verified, exploitable impact.
• Issues that require physical access to a victim's device.
• Self-XSS or attacks requiring the victim to paste an attacker-supplied payload into their own browser console.
• Missing security headers without a demonstrable exploit.
• Rate-limiting or brute-force findings without a working bypass.
• Reports based purely on the version of a dependency, without a working exploit.
• Social engineering of PracticPro employees, customers, or contractors.
• Denial of service.

1. Acknowledgement within 3 business days.
2. Triage within 10 business days, including a preliminary severity assessment and timeline.
3. Resolution on a schedule appropriate to severity. We aim to fix critical issues within days, high-severity issues within weeks, and lower-severity issues within the next normal release cycle.
4. Coordinated disclosure, if you would like to publish details, after the fix is deployed and we have agreed on timing.

PracticPro does not currently run a paid bug bounty program. We recognize meaningful contributions on this page (with the researcher's permission) and may offer thank-you gestures at our discretion.