Security at ClearMakes
Our Vulnerability Disclosure Policy (VDP)
Last Updated: September 28, 2026
The security of our systems is our highest priority. We welcome the help of security researchers in identifying potential vulnerabilities. This policy explains how to report an issue. Our security page describes how we protect your data.
How to Report a Security Vulnerability
If you believe you have discovered a security vulnerability in a ClearMakes service, please report it to us at:
Please include the following details in your report:
- A clear description of the vulnerability, including its potential impact on user data.
- Detailed steps to reproduce the issue, including any URLs or code snippets.
- How we can contact you to follow up.
Our Commitment ("Safe Harbor")
We will not take legal action against or suspend accounts for research conducted in accordance with this policy. We consider security research into ourplatform integrations to be authorized and beneficial to the community.
Rules of Engagement
To ensure the safety of our users, we ask that you strictly avoid:
- Accessing, modifying, or deleting any user data that is not your own.
- Denial of Service (DoS) attacks or actions that disrupt the service.
- Social engineering or phishing attacks against our employees or users.
- Making vulnerability information public before we have had reasonable time to fix it.
Exclusions
- Automated scanner results without a working proof-of-concept (PoC).
- Missing security headers without a demonstrated impact on our security architecture.
- Self-XSS (Cross-Site Scripting) without a lateral attack vector.
- Disclosures of publicly known software versions.