Security & Responsible Disclosure Policy

We build security tooling, and we hold our own service to the same standard. If you believe you have found a security vulnerability in GetCodeAudit, we genuinely want to hear from you and we will work with you in good faith to confirm and fix it.

Scope

This policy covers the getcodeaudit.com web application and its supporting infrastructure that we operate. It does not authorize testing of:

• Any third-party service we rely on (for example our payment processor or hosting provider) — report those to the relevant vendor.
• The websites of our customers, or any target submitted through the scanner.

How to test responsibly

When investigating, please:

• Make a good-faith effort to avoid privacy violations, data destruction, and interruption of the service.
• Only interact with accounts you own or have explicit permission to access.
• Do not run automated scanning at a volume that could degrade the service for others.
• Do not access, modify, or exfiltrate data that is not yours. If you encounter personal data, stop and tell us.
• Give us a reasonable opportunity to remediate before any public disclosure.

What you can expect from us

• We will acknowledge your report as quickly as we reasonably can.
• We will keep you updated as we investigate and remediate.
• We will not pursue or support legal action against researchers who act in good faith and within this policy.
• With your permission, we are happy to credit you once the issue is resolved.

No bounty (for now)

We are a small, independent operation and do not currently run a paid bug-bounty program. We deeply appreciate responsible reports regardless, and will acknowledge contributors publicly where they wish.

Machine-readable contact details: /.well-known/security.txt