Found a vulnerability?

What we ask. Give us reasonable time to fix before publishing. Do not access or alter other people’s data beyond what proves the issue, and do not run denial-of-service or social-engineering tests.

What we promise. We will not take legal action over good-faith research within these rules, we will credit you if you want credit, and if member data was exposed we tell the affected members rather than hoping nobody noticed.

How the platform is built. Card payments are handled entirely by Stripe, and card numbers never touch our servers. A business’s project records are walled off from another business at the database layer, and an automated test checks that on every change. Every response carries strict transport and content-type protections.

Machine-readable contact details live at /.well-known/security.txt.