Vulnerability Disclosure Policy

Email security@stackmentalist.com with:

• A description of the vulnerability and its potential impact.
• Steps to reproduce (proof-of-concept, affected URL/endpoint, request/response as relevant).
• Your name/handle for acknowledgement (optional).

Please encrypt sensitive details where possible.

• We will acknowledge new reports within a few business days.
• We will investigate and keep you reasonably informed of progress.
• We will not pursue legal action against researchers who act in good faith and follow this policy.
• With your permission, we will credit you once the issue is resolved.

We consider security research conducted under this policy to be authorised, provided you:

• Make a good-faith effort to avoid privacy violations, data destruction, and service disruption.
• Do not access, modify, or exfiltrate data that does not belong to you — use only test accounts you control. Do not attempt to access one tenant's data using another tenant's account.
• Do not run denial-of-service, spam, social-engineering, or physical attacks.
• Give us reasonable time to remediate before public disclosure and coordinate timing with us.

The following are generally not actionable under this policy:

• Reports from automated scanners without a working proof-of-concept.
• Missing security-header best practices with no demonstrated impact.
• Rate-limiting reports on non-sensitive, unauthenticated endpoints.
• Issues in third-party services we do not control, including the connected HRMS (CrewKnit) — report those to the relevant operator.

In scope: payvio.stackmentalist.com and tsm-payvioapi.stackmentalist.com. The connected HRMS (CrewKnit) and other third-party services are governed by their own policies.