Responsible Disclosure Policy

We welcome reports from security researchers and anyone who finds a vulnerability in Searchedly. If you follow this policy, we'll treat your research as authorized and work with you to fix the problem.

How to report

Email security@searchedly.com with:

• what you found and where (URL, endpoint or component);
• steps to reproduce it, with a proof of concept if you have one;
• the impact you think it has;
• how to contact you, and whether you'd like to be credited.

Please don't include other people's data. Our contact details are also published at /.well-known/security.txt.

In scope

• searchedly.com and its subdomains
• The Searchedly API, hosted MCP connectors and agent endpoints
• Searchedly's crawler, SearchedlyBot

Out of scope

• Denial-of-service, load or spam testing
• Social engineering or phishing of our staff or customers, and physical attacks
• Third-party services we use (report those to the vendor), and customers' own websites or APIs
• Reports from automated scanners without a demonstrated impact; missing best-practice headers or cookie flags without an exploit; clickjacking on pages with no sensitive actions; self-XSS; email spoofing settings (SPF/DMARC) on domains we don't send from

Rules

• Only test against accounts you own or have explicit permission to use. Create your own organizations for testing.
• If you encounter someone else's data, stop, don't keep or share it, and tell us right away.
• Don't degrade the service, change or delete data, or keep access longer than needed to show the issue.
• Give us a reasonable time to fix the issue before you disclose it publicly. We'll agree a date with you, normally within 90 days.

Safe harbour

If you act in good faith and follow this policy, we consider your research authorized under laws such as the US Computer Fraud and Abuse Act and the DMCA, won't take legal action against you, and will say so if someone else does. If you're unsure whether something is allowed, ask us first.

What you can expect

• An acknowledgement within 3 business days.
• An initial assessment within 10 business days, and regular updates until it's fixed.
• Fix targets by severity: critical within 7 days, high within 30 days, medium within 90 days.
• Credit in our acknowledgements if you'd like it, once the issue is fixed.

We don't currently run a paid bug bounty.