Security
Found a security problem? Please tell us first.
This is our vulnerability disclosure policy. It says how to report a problem, what not to do while you look, which systems it covers, and what we promise people who follow it.
Reporting
How to report
Email security@launch500.com with what you found, how to reproduce it, and the web address where it happens. Please send one report per issue.
You can also use the contact form and choose “A security report”.
Our security.txt gives the same address in the standard format (RFC 9116), and points here.
While you look
Please do not
- Use denial of service attacks or load testing.
- Read, change, export or keep data that is not yours. If you reach someone else's data, stop at the first record that shows the issue, and tell us in your report.
- Use social engineering, such as phishing, against our staff or users, or make any physical attack.
- Run automated scanners that send more than a few requests a second.
- Publish the issue before we have fixed it or 90 days have passed since your report, whichever is sooner.
Scope
What this policy covers
In scope
- launch500.com, and any subdomain of it that we run ourselves.
Out of scope
- Stripe's checkout and payment pages, and the systems of Supabase, Cloudflare and our other providers. Please report those to the provider: each has its own policy.
- Reports that need a device that is already compromised.
- Missing best-practice headers or settings with no shown impact.
Safe harbour
Safe harbour, in good faith
If you act in good faith and follow this policy, we will not take legal action against you for that research. If a third party takes legal action against you for it, we will say that your research followed this policy.
This does not cover breaking the law in other ways, or other companies’ systems: our providers have their own policies.
Send a report
security@launch500.com (or use the contact form).
No bug bounty
There is no bug bounty: we do not pay for reports.