Security & Vulnerability Disclosure

We take the security of the ReadyIQ platform seriously. If you believe you've found a security vulnerability, we want to hear from you. This page describes how to report it and what you can expect from us in response.

How to Report

Email security@readyiq.ai with a description of the issue, steps to reproduce it, and any relevant proof-of-concept. If possible, include:

• The URL, endpoint, or component affected
• The type of vulnerability (e.g. injection, auth bypass, XSS)
• Steps to reproduce, or a minimal proof-of-concept
• The potential impact, as you understand it

Machine-readable contact details are also published at /.well-known/security.txt per RFC 9116.

What to Expect

• We aim to acknowledge reports within 3 business days.
• We'll investigate, assess severity, and follow up with you as we make progress — timelines vary with complexity and severity.
• We'll let you know once a fix has shipped, and are happy to credit researchers who report responsibly, if you'd like that.

Safe Harbor

We consider security research conducted in good faith — under this policy, without accessing or modifying data beyond what is needed to demonstrate the issue, and without disrupting the service for other users — to be authorized. We will not pursue legal action against researchers who make a good-faith effort to comply with this policy.

Scope & Expectations

This is a responsible-disclosure policy, not a paid bug bounty program — we don't currently offer monetary rewards for reports. In scope: the readyiq.ai web application, its public APIs, and the ReadyIQ Chrome extension. Out of scope: social engineering, physical security, denial-of-service testing, and third-party services we integrate with (report those to the vendor directly).

Please give us a reasonable time to investigate and remediate an issue before disclosing it publicly.

Contact