Security disclosure policy
If you think you found a security problem in RankPilot, tell us. We would rather hear about it from you than read about it. This page says what is in scope, how to report, and what to expect.
Scope
The RankPilot web app and its API on rank.hanzla.com, the client portal, the MCP endpoint, the webhooks we receive and send, and the marketing pages on the same domain.
Out of scope
- Denial of service, load testing and anything that degrades the service for others.
- Social engineering or phishing of our staff or customers, and physical attacks.
- Third-party services we use (Google, Lemon Squeezy, our e-mail and hosting providers). Report those to the provider.
- Findings that need a rooted device, a malicious browser extension or stolen credentials.
- Missing best-practice headers with no demonstrated impact.
How to report
Write to security contact address not configured yet. Say what you found, the URL or request involved, and the steps to reproduce it. A proof of concept helps; please do not include real customer data. The same address is in our security.txt.
What to expect
We acknowledge a report within 72 hours. Our targets for a fix, from the day we confirm the problem:
- Critical: 7 days.
- High: 30 days.
- Medium: 90 days.
- Low: when we next touch the area.
We tell you when it is fixed. If we cannot meet a target we say so and why. There is no bug bounty in this version of RankPilot. We credit you by name or handle on request.
Safe harbor
If you act in good faith, follow this policy, and stop once you have shown the problem, we will not start legal action against you for the research and will not ask anyone else to. Use your own account or a test workspace, touch only the data you need to show the issue, do not read, change or keep other people's data, and give us a reasonable time to fix before you publish. This is a statement of intent, not a legal waiver of rights of third parties.