Vulnerability Disclosure

Longlist.io is dedicated to protecting data safety and security through its Vulnerability Disclosure Program. The program aims to minimize the impact of potential security flaws on their tool and users.

Reporting Procedures

To report a vulnerability:

• Contact Method: Email vulnerabilities to security@longlist.io
• Eligibility: Vulnerabilities must exist in the latest public release (including public betas)
• Scope: Only security vulnerabilities will be considered

Guidelines and Scope Limitations

1. Do not cause harm or hinder application functionality
2. Provide a detailed vulnerability summary, including:
   • Target
   • Steps to reproduce
   • Tools used
   • Artifacts discovered
3. Avoid intentionally accessing non-public Longlist.io data beyond what’s necessary to demonstrate the vulnerability
4. Do not compromise customer privacy or service operations
5. Comply with all applicable laws and regulations
6. Do not disclose vulnerabilities without prior written consent from Longlist.io

Out of Scope Activities

The following will be considered out of scope:

• Automated tool or script findings
• Issues without clearly identified security impact
• Missing security headers
• Descriptive error messages
• Speculative information without clear documentation

Important Notes

• Findings must have clear relevance and impact
• Longlist.io reserves the right to not act on findings with no real risk
• Violations of program terms may be treated as acting in bad faith
• No remuneration is guaranteed for vulnerability disclosures