Security and Vulnerability Disclosure

Security program.

Spot & Rally uses managed identity and payment providers, environment separation, least privilege, encrypted transport, signed webhooks, idempotent ledgers, rate limits, secure headers, audit trails, dependency checks, reviewed migrations, and backup/recovery rehearsals. OWASP ASVS Level 2 is the internal application-security verification baseline; this is not a public certification claim.

Report a vulnerability.

Send the affected URL or feature, reproducible steps, impact, and safe proof to security@spotandrally.com. Do not include secrets or personal data you do not own. We target acknowledgment within one business day for credible urgent reports.

Good-faith research is authorized when it avoids privacy violations, social engineering, denial of service, malware, destructive actions, persistence, provider-account attacks, automated high-volume scanning, or access beyond the minimum needed to demonstrate the issue. Stop and report if you encounter personal data. This policy does not authorize testing of Clerk, Stripe, Vercel, Neon, Resend, Upstash, or another third party.

Disclosure.

Give us a reasonable opportunity to investigate and remediate before public disclosure. We do not promise a bounty. We will not pursue legal action for accidental, good-faith activity that stays within this policy, but we cannot bind third parties or excuse unlawful conduct.