Security Policy

Vulnerability Disclosure & Bug Bounty Policy

Last Updated: 2026-03-16

At SetSale, we take the security of our systems and our users' data very seriously. We recognize the valuable role that independent security researchers play in internet security. This policy outlines our expectations for engaging with us, what systems are in scope, and how we reward confirmed vulnerabilities.

Safe Harbor

When conducting vulnerability research according to this policy, we consider this research to be authorized. We will not initiate or support legal action against you related to your research.

If legal action is initiated by a third party against you in connection with activities conducted under this policy, we will take steps to make it known that your actions were conducted in compliance with this policy.

Rules of Engagement

To qualify for our Safe Harbor and reward program, you must strictly adhere to the following rules:

• Do not impact users: Never attempt to access, modify, or delete data belonging to other users. Always use your own test accounts.
• No disruptive testing: Denial of Service (DoS/DDoS) and brute-force attacks are strictly prohibited.
• No social engineering: Phishing, vishing, or any physical attempts against our employees, offices, or data centers are strictly out of scope.
• Keep it confidential: You must not publicly disclose the vulnerability until we have resolved it and given you explicit written permission to publish.
• Stop and report: If you encounter sensitive data (e.g., Personally Identifiable Information, financial data, or proprietary source code), stop testing immediately, do not save the data, and report the issue to us.

Scope

In-Scope Targets

The following assets are eligible for testing and monetary rewards:

• app.setsale.ai

Out-of-Scope Targets

The following assets are explicitly excluded from this program:

• www.setsale.ai (e.g. marketing materials)
• Third-party vendors or services integrated into our platform (e.g., Stripe, AWS, Auth0)

Out-of-Scope Vulnerabilities

We generally do not accept reports for the following, unless you can demonstrate a chain that leads to a severe impact:

• Missing security headers or flags (e.g., Strict-Transport-Security, HTTPOnly) without a demonstrable exploit.
• Email spoofing issues (e.g., missing or misconfigured SPF/DKIM/DMARC).
• Clickjacking on pages with no sensitive actions.
• Vulnerabilities requiring unlikely user interaction or physical access to an unlocked device.
• Disclosure of known public files or directories (e.g., robots.txt).

Reward Structure

We reward based on the severity of the vulnerability, determined at our discretion using the Common Vulnerability Scoring System (CVSS) guidelines.

Additional Reward Rules:

• Rewards are paid via PayPal or Venmo.
• In the event of duplicate reports, the reward will be given to the first researcher who submitted a clear, reproducible report.
• We reserve the right to increase rewards for exceptional reports or decrease them if the report lacks clarity or a Proof of Concept (PoC).

How to Report a Vulnerability

Please email your findings to security@setsale.ai.

To help us triage your report quickly, please include:

• A clear description of the vulnerability and its potential impact.
• Step-by-step instructions to reproduce the issue (a video or written Proof of Concept is highly appreciated).
• Your IP address used during testing (so we can review our logs).

Our Commitment to You:

• We will acknowledge receipt of your report within 3 business days.
• We will provide an initial triage assessment within 7 business days.
• We will keep you updated on the remediation process and issue your reward within 14 days of verifying the fix.