// SECURITY · DISCLOSURE
Security Policy
If you believe you have found a security vulnerability in Secure QR, please report it to us privately before any public disclosure. This page is the disclosure policy referenced by our /.well-known/security.txt file.
1
Scope
In scope: the Secure QR web application, the API, the public QR gate (/q/<opaqueId>), the magic-link consumer (/a/<token>), and the encryption and access-control model described on the Security page.
Out of scope: denial-of-service testing, automated scanning that generates high request volume, social engineering against our team or users, physical security, and any third-party service we depend on but do not control — report those directly to that vendor.
2
How to report
Email (pending registration) with a description of the issue, the steps to reproduce it, and its potential impact. Encrypt sensitive reports if you can; a PGP key is not published yet, so state that constraint in your report and we will arrange a secure channel.
Do not include real customer data in a report — a redacted proof of concept is enough.
3
Safe harbour
We will not pursue legal action against a researcher who, acting in good faith:
- reports a vulnerability privately and gives us a reasonable opportunity to fix it before any public disclosure,
- avoids privacy violations, service disruption, and destruction of data during testing,
- only interacts with accounts and data they own or have explicit permission to test, and
- does not exploit a vulnerability beyond what is needed to demonstrate it (for example: stop at proof of access, do not exfiltrate or modify data).
We consider security research conducted under these terms to be authorized, and we will work with you to understand and resolve the issue quickly.
4
Response SLAs
We acknowledge every report within 3 business days. After that, our response time scales with severity:
| Severity | Initial assessment | Guideline |
|---|---|---|
| Critical | 24 hours | Remotely exploitable, no auth required, or a break of the encryption/tenant-isolation model |
| High | 72 hours | Requires authentication or user interaction, but has real impact on confidentiality or integrity |
| Moderate | 1 week | Limited impact, or requires an unlikely precondition |
| Low | 2 weeks | Best-practice hardening with no direct exploit path |
These are guidelines, not a contractual commitment. Our dependency-vulnerability triage process and CI gate are documented separately in docs/SECURITY.md.
5
No bounty program
We do not currently run a paid bug bounty program. We are happy to credit researchers, with their permission, once a fix ships.
6
Disclosure
We ask for coordinated disclosure: please give us a reasonable window to ship a fix before publishing details. We will keep you updated on our progress and agree on a disclosure timeline with you once the issue is confirmed.