Responsible disclosure policy

Email security@reliatic.com with the following information:

• A clear description of the vulnerability.
• Steps to reproduce, including any required preconditions.
• Potential impact assessment.
• Your contact information so we can follow up.
• Optional but appreciated: a PoC and any suggested remediation. For encrypted communication, request our current PGP key by emailing security@reliatic.com with the subject "PGP key request" — we rotate keys per engagement and deliver them out-of-band.

• Within 24 hours (business days): acknowledgment of your report.
• Within 72 hours: initial triage and severity assessment.
• Within 30 days: remediation of critical issues (auth bypass, RCE, tenant-isolation bypass, data exposure).
• Within 90 days: remediation of remaining valid findings, after which coordinated public disclosure is allowed (subject to mutual agreement).
• Status updates at least every 14 days while the issue is under investigation.

In-scope: reliatic.com, all subdomains, the marketing site, and the authenticated platform on staging.reliatic.com.

Out-of-scope: third-party services we depend on (Vercel, Sentry, Resend, Upstash, PostHog — see /legal/subprocessors); social-engineering attacks against employees or customers; physical attacks; DoS that degrades production availability; and findings whose only impact requires attacker-controlled accounts on production data.

Examples of valid critical findings: authentication bypass, SQL injection with data access, remote code execution, cross-tenant data access, audit log tamper, escalation of privilege to a higher role.

Reliatic will not pursue legal action against researchers who:

• Report vulnerabilities responsibly and confidentially via the channel above.
• Test only against staging.reliatic.com — never production.
• Do not access, modify, or exfiltrate user or tenant data beyond what is strictly necessary to demonstrate the finding.
• Do not perform attacks that degrade service availability or affect other users.
• Do not publicly disclose the issue before remediation is complete and disclosure is mutually agreed.

We consider research conducted in accordance with this policy to be authorized access under the Computer Fraud and Abuse Act and analogous laws.

We acknowledge researchers who report valid findings in our Hall of Fame (with your permission). Exceptional findings may receive a discretionary reward — we do not run a formal bug-bounty program at this time.