Effective Date: March 1, 2026
Human Aspire welcomes reports from security researchers who identify vulnerabilities in our products and services. This policy describes how to report vulnerabilities and what to expect from us.
Scope
This policy applies to all services operated under \*.human-aspire.org.
How to Report
Send vulnerability reports to support@human-aspire.org.
Please include:
- A description of the vulnerability and its potential impact
- Steps to reproduce the issue
- Any supporting evidence (screenshots, logs, proof-of-concept)
What to Expect
- We will acknowledge receipt of your report within 5 business days.
- We will provide an initial assessment within 15 business days.
- We will work to remediate confirmed vulnerabilities promptly.
- We will notify you when the issue has been resolved.
Safe Harbor
We will not pursue legal action against individuals who:
- Report vulnerabilities in good faith and in compliance with this policy
- Avoid accessing, modifying, or deleting data belonging to other users
- Do not disrupt or degrade our services
- Allow us reasonable time to address the issue before any public disclosure
Out of Scope
- Social engineering (phishing, vishing, pretexting)
- Denial of service attacks
- Physical security testing
- Third-party services not operated by Human Aspire
Disclosure
We ask that you coordinate disclosure with us and refrain from publishing details of the vulnerability until we have had reasonable time to address it. We are committed to resolving confirmed vulnerabilities as quickly as possible.