AuditFile Bug Bounty Program
Help us protect AuditFile and the firms that rely on it. We welcome responsible vulnerability reports and proposals for coordinated security research.
Contact us before testing
Written approval is required before any security testing. Contact us to agree on the systems, test accounts, methods, and testing window. Only the scope we approve in writing is authorized. This page does not grant permission to test or change our Terms of Service.
Keep testing safe
- Use only approved test environments, accounts, and synthetic data. Customer accounts, customer data, and third-party systems are out of scope.
- Do not disrupt service, overload systems, phish people, guess passwords, install persistence, or alter or delete data.
- If you encounter sensitive data or unexpected access, stop immediately and report it privately. Do not download, copy, or share that data.
Report a vulnerability
Email [email protected] with the subject “Security Research” to report an issue or request testing approval. Reports of issues encountered accidentally are welcome; do not test further without approval.
Include the affected feature, potential impact, and minimal reproduction steps with redacted evidence. Do not email passwords, tokens, or customer data. Contact us to arrange a secure channel if sensitive details are necessary.
Bounties and disclosure
Bounties are discretionary. Eligibility and payment terms must be agreed in writing before testing; submitting a report does not guarantee payment. Coordinate public disclosure with AuditFile so we have an opportunity to investigate and fix the issue.
AI-assisted security research
We welcome conversations with AI model providers and security researchers about access to advanced models for defensive security research and red-team evaluations of AuditFile's own software. Any work must follow the same written scope, use synthetic data, maintain human oversight, and comply with the model provider's terms. Do not send customer data or credentials to AI tools.