Responsible Disclosure Policy

Reporting

Send a concise report to [email protected] with the subject “Security vulnerability report.”

Include:

• The affected ASCA service or URL.
• A clear description of the issue and potential impact.
• Minimal reproducible steps using synthetic data.
• The date and time observed.
• Any request identifiers that contain no credentials or personal information.
• A safe contact method for follow-up.

Do not email passwords, access tokens, payment credentials, customer content, private keys, illegal content, or large sensitive attachments. Ask for a protected transfer method if evidence is necessary.

Good-faith research expectations

To qualify for ASCA’s good-faith disclosure process, a researcher must:

• Minimize access and stop after confirming the issue.
• Use accounts and organizations they control.
• Avoid privacy intrusion, persistence, privilege expansion, and data changes.
• Avoid social engineering, physical access, denial of service, spam, malware, destructive testing, automated volume, and third-party systems.
• Preserve confidentiality until ASCA has had a reasonable opportunity to investigate and remediate.
• Delete any inadvertently obtained ASCA data after ASCA confirms preservation is no longer required.

Out of scope without written authorization

Testing is not authorized against connected providers, customer-controlled systems, production data belonging to others, physical devices, event operations, payment networks, election records, or employee and volunteer accounts.

Automated scanners that generate material traffic, credential testing, rate limit bypass, phishing, prompt-injection campaigns against real users, and public disclosure of an unremediated issue require prior written authorization.

ASCA response

ASCA aims to acknowledge a usable report, assess severity, request necessary clarification, and coordinate remediation and disclosure. This policy does not promise a response deadline, bounty, payment, credit, or fixed embargo duration.

Duplicate, non-security, purely theoretical, or previously known reports may receive a limited response. ASCA may involve an affected organization or provider when necessary while limiting disclosure.

No authorization to violate law

This policy does not authorize unlawful conduct, access beyond the stated scope, violation of another entity’s terms, or retention of personal data.

ASCA takes documented good faith and compliance with this policy into account when deciding how to respond to a report. This policy does not grant legal safe harbor, immunity, authorization to violate law, or a waiver of ASCA's rights, and ASCA cannot bind another organization, service provider, government authority, or law-enforcement agency.