Vulnerability Disclosure Policy

In scope: tryfulcrum.ai and its subdomains, and the Fulcrum platform. Out-of-scope systems include third-party services we use but do not operate.

Email [email protected] with a description of the issue, the affected endpoint or component, and reproduction steps. Include enough detail for us to verify the issue. A PGP key is available on request.

If you research and report in good faith, within scope, without harming users or data, we will not pursue legal action against you for that research. Do not access, modify, or exfiltrate data beyond what is needed to demonstrate the issue.

We acknowledge reports within 48 hours, keep you informed as we investigate, and fix confirmed issues on a timeline matched to severity.

With your permission we credit meaningful reports. We do not currently run a paid bounty program, but we may reward significant findings at our discretion.

Denial-of-service testing, spam, social engineering of staff or customers, physical attacks, and findings that require unlikely user interaction without a demonstrated security impact.

Please coordinate with us before publishing details. We ask for a reasonable window to fix the issue, and we will work with you on timing rather than sit on reports.