Responsible Disclosure Policy

Version 2026-05-06

We appreciate the security community’s efforts to keep TalentGeenie safe for our users. This policy explains how to report vulnerabilities and what to expect in return.

How to report

• Email security@talentgeenie.com with reproduction steps, impact, and any proof-of-concept material.
• Encrypt sensitive details using our PGP key at /.well-known/pgp-key.asc.
• Please give us a reasonable time to investigate before public disclosure (we aim for 90 days).

Scope

In scope:

• talentgeenie.com and subdomains we operate
• Our public APIs documented in docs/03-API-Surface.md
• Mobile clients we publish

Out of scope:

• Denial-of-service / volumetric attacks
• Social engineering of staff or vendors
• Physical attacks against our premises or staff
• Findings that require root/jailbreak of the user’s own device
• Issues in third-party sub-processors (please report to the vendor)

Safe harbour

We will not pursue civil or criminal action against researchers who:

• Act in good faith and follow this policy.
• Avoid privacy violations, data destruction, and service disruption.
• Use only test accounts they own or have explicit permission to access.
• Do not exfiltrate data beyond what is necessary to demonstrate the issue.

Our commitments

• Acknowledge receipt within 3 business days.
• Provide a triage decision within 10 business days.
• Credit you on our acknowledgements page (with consent).
• A formal bug-bounty programme is planned for Phase 2 (see docs/00-Assumptions-and-Decisions.md S-07).

Machine-readable contact

See /.well-known/security.txt (RFC 9116).