Vulnerability Disclosure Policy

Last updated: October 2026

Clarifi Technologies welcomes reports of security vulnerabilities in our systems and products from researchers, customers, and the public. This page explains how to report one, what to expect from us, and the rules we ask reporters to follow.

Scope

This policy covers systems, applications, and services owned and operated by Clarifi Technologies, including our public website and customer-facing products. Vulnerabilities in third-party services should be reported to that vendor, though you may also tell us if one affects our customers.

How to report

Email [email protected] and include:

• A description of the issue and the affected system or URL
• Steps to reproduce, and any proof of concept needed to understand it
• Your assessment of impact, and your contact details if you want a reply

If you need to send sensitive material, ask in your first email and we will arrange a secure method.

What we ask of reporters

• Do not access, modify, copy, or delete other people’s data; stop and report if you encounter it
• Do not degrade service (no denial-of-service, load testing, or spam)
• Do not use social engineering, phishing, or physical attacks against our people or facilities
• Give us a reasonable time to remediate before any public disclosure

What you can expect from us

• We will acknowledge your report within 3 business days
• We will assess and prioritize it according to severity
• We will credit you on request once the issue is resolved, unless you prefer to stay anonymous

Good-faith research

We do not currently operate a paid bug bounty program, but we will commit to working with anyone who reports a vulnerability in good faith and follows this policy. This does not authorize illegal activity.