Vulnerability disclosure

Draft. Written for the pre-launch prototype and not yet reviewed by a lawyer. It will be updated when the company is incorporated.

Overview

Pathlift is run by a very small team. We take reports seriously and would rather hear about a problem from you than find out later. Pathlift keeps no account data on its servers today (your CV and board stay in your browser), but the site, the job board and the request that prepares applications are all in scope.

How to report

Email hello@pathlift.co with the subject “Security report”. Include what you found, the steps to reproduce it, the URL or request involved, and what an attacker could do with it. Screenshots or a short video help. We'll confirm we've received it within 3 working days.

Our security.txt lists the same contact.

In scope

• pathlift.co and its pages, including the job board and job pages
• The dashboard at pathlift.co/app
• Pathlift's own API endpoints under pathlift.co/api

Out of scope

• Denial-of-service or load testing
• Social engineering of anyone, including the founder
• Reports that only list automated scanner output without a working impact
• Problems in third-party services we use (for example our hosting provider or Anthropic's API); report those to them
• The career sites of the companies whose postings we show

Rules for research

• Only test with data that is yours. Don't access, change or delete anyone else's data.
• Stop and tell us as soon as you reach data that isn't yours.
• Don't run automated tools that send large amounts of traffic.
• Give us a reasonable time to fix the problem before you talk about it publicly.

Coordinated disclosure

We aim to fix confirmed problems within 30 days, and we'll keep you updated along the way. Once it's fixed, you're welcome to publish your findings; tell us first so we can agree on a date.

What we promise

• We'll reply, and we'll tell you what we decided and why.
• We'll credit you on the changelog if you'd like.
• We won't share your details without your consent.

Safe harbour

If you follow this page in good faith, we won't take legal action against you for your research and we'll consider it authorised. If in doubt about whether something is allowed, ask us first.

Rewards

Pathlift is pre-launch and has no budget for paid bounties yet. We can offer credit and our thanks. This will change if that changes.

Eligibility

Anyone may report. Please don't report if you are under 18 or if local law prevents you from taking part.

Changes to this page

We may update this page. The date at the top shows the last change.