---
title: "Reporting a security vulnerability · Launch500"
description: "How to report a security vulnerability in Launch500, what the policy covers, what not to do while you look, and our safe harbour for research in good faith."
canonical: "https://launch500.com/trust/security"
---

Security

# Found a security problem? Please tell us first.

This is our vulnerability disclosure policy. It says how to report a problem, what not to do while you look, which systems it covers, and what we promise people who follow it.

Reporting

## How to report

Email [security@launch500.com](mailto:security@launch500.com) with what you found, how to reproduce it, and the web address where it happens. Please send one report per issue.

You can also use the [contact form](https://launch500.com/contact?topic=security) and choose “A security report”.

Our [security.txt](https://launch500.com/.well-known/security.txt) gives the same address in the standard format (RFC 9116), and points here.

While you look

## Please do not

- Use denial of service attacks or load testing.
- Read, change, export or keep data that is not yours. If you reach someone else's data, stop at the first record that shows the issue, and tell us in your report.
- Use social engineering, such as phishing, against our staff or users, or make any physical attack.
- Run automated scanners that send more than a few requests a second.
- Publish the issue before we have fixed it or 90 days have passed since your report, whichever is sooner.

Scope

## What this policy covers

In scope

- launch500.com, and any subdomain of it that we run ourselves.

Out of scope

- Stripe's checkout and payment pages, and the systems of Supabase, Cloudflare and our other providers. Please report those to the provider: each has its own policy.
- Reports that need a device that is already compromised.
- Missing best-practice headers or settings with no shown impact.

Safe harbour

## Safe harbour, in good faith

If you act in good faith and follow this policy, we will not take legal action against you for that research. If a third party takes legal action against you for it, we will say that your research followed this policy.

This does not cover breaking the law in other ways, or other companies’ systems: our providers have their own policies.

Send a report

[security@launch500.com](mailto:security@launch500.com) (or use the [contact form](https://launch500.com/contact?topic=security)).

No bug bounty

There is no bug bounty: we do not pay for reports.

```json
[
  {
    "@context": "https://schema.org",
    "@type": "Organization",
    "@id": "https://launch500.com#organisation",
    "name": "Launch500",
    "alternateName": "Launch 500",
    "legalName": "99 Developers Ltd",
    "url": "https://launch500.com",
    "description": "The annual list of startups building software worth paying for, and the Crash Test that decides who is considered.",
    "logo": {
      "@type": "ImageObject",
      "url": "https://launch500.com/brand/launch500-mark.svg",
      "width": 512,
      "height": 512
    },
    "email": "hello@launch500.com",
    "address": {
      "@type": "PostalAddress",
      "streetAddress": "55 Queen's Gate",
      "addressLocality": "London",
      "addressRegion": "England",
      "postalCode": "SW7 5JW",
      "addressCountry": "GB"
    },
    "identifier": {
      "@type": "PropertyValue",
      "propertyID": "Companies House company number",
      "value": "17257492"
    },
    "sameAs": [
      "https://find-and-update.company-information.service.gov.uk/company/17257492"
    ],
    "publishingPrinciples": "https://launch500.com/trust/how-we-make-money",
    "ownershipFundingInfo": "https://launch500.com/trust/how-we-make-money",
    "correctionsPolicy": "https://launch500.com/trust/corrections",
    "actionableFeedbackPolicy": "https://launch500.com/trust/corrections"
  },
  {
    "@context": "https://schema.org",
    "@type": "WebSite",
    "@id": "https://launch500.com#website",
    "name": "Launch500",
    "alternateName": [
      "Launch 500"
    ],
    "url": "https://launch500.com",
    "inLanguage": "en-GB",
    "publisher": {
      "@id": "https://launch500.com#organisation"
    }
  }
]
```

```json
{
  "@context": "https://schema.org",
  "@type": "Article",
  "@id": "https://launch500.com/trust/security#article",
  "headline": "Reporting a security vulnerability",
  "description": "How to report a security vulnerability in Launch500, what the policy covers, what not to do while you look, and our safe harbour for research in good faith.",
  "url": "https://launch500.com/trust/security",
  "mainEntityOfPage": "https://launch500.com/trust/security",
  "author": {
    "@id": "https://launch500.com#organisation"
  },
  "publisher": {
    "@id": "https://launch500.com#organisation"
  }
}
```