Security Disclosure Policy

If you believe you have discovered a security vulnerability in any Tools for Democracy software product, please report it to:

Do not report security vulnerabilities through public GitHub issues, forums, or social media.

To help us investigate and respond efficiently, please provide:

Severity-Based Fix Targets

We follow a 90-day coordinated disclosure timeline. We ask that reporters:

1. Allow us 90 days from the date of the initial report to develop and release a fix before any public disclosure.
2. Make a good-faith effort to avoid accessing or modifying data that does not belong to you.
3. Avoid disruption to production systems during testing.

If we are unable to resolve the issue within 90 days, we will coordinate with the reporter on an appropriate disclosure timeline.

Tools for Democracy LLC will not pursue legal action against individuals who:

• Report vulnerabilities in good faith and in compliance with this policy.
• Make a good-faith effort to avoid privacy violations, data destruction, and service disruption.
• Do not exploit the vulnerability beyond what is necessary to demonstrate it.
• Do not publicly disclose the vulnerability before the coordinated disclosure date.

This safe harbor applies to legal claims under our control (e.g., breach of contract, computer fraud). It does not bind third parties or government agencies.

This policy covers all software products published by Tools for Democracy LLC:

We appreciate security researchers who help us keep our software safe. With your permission, we will acknowledge your contribution in our release notes. We do not currently operate a paid bug bounty program.