Responsible Disclosure Policy

Last updated: October 2026

Our Commitment

PreCog Security is committed to working with security researchers to protect our users and infrastructure. We welcome responsible reports of vulnerabilities in our systems and the open-source projects we maintain.

How to Report

Email timlangeveldt@gmail.com with:

• Description of the vulnerability
• Steps to reproduce
• Potential impact
• Any suggested fixes (optional)

Severity Classification

We use CVSS v3.1 as a baseline:

• CRITICAL — RCE, auth bypass, full system compromise
• HIGH — Privilege escalation, significant data exposure
• MEDIUM — Limited data exposure, CSRF, XSS
• LOW — Information disclosure, minor issues

What to Expect

• Acknowledgment within 48 hours
• Initial assessment within 5 business days
• Regular updates every 14 days until resolution
• Credit in the advisory (unless you prefer anonymity)

Safe Harbor

We consider research conducted in accordance with this policy to be authorized. We will not pursue legal action against researchers who:

• Make a good faith effort to avoid privacy violations and service disruption
• Only interact with accounts you own or with explicit permission
• Do not access, modify, or delete user data
• Report vulnerabilities promptly

Bounty Eligibility

While we do not currently run a paid bounty program for our own infrastructure, we actively contribute to and maintain bounty programs on Algora and Opire. Reports against those platforms' funded issues qualify for platform bounties.

Out of Scope

• Vulnerabilities in third-party services we use (GitHub, etc.)
• Social engineering of PreCog Security personnel
• Denial-of-service attacks
• Automated scanner findings without manual verification