Vulnerability Disclosure Policy

Overview

This is a small operation — one developer, several products, real users. If you've found a security issue in something I've built, I want to know about it. I'll take your report seriously, respond promptly, and work to fix legitimate issues. I don't have a bug bounty program, but I do have a clear process and genuine appreciation for responsible disclosure.

Scope

What's covered

In scope

sherpod.com
boardfolio.app
fammeet.net
famtrust.life
xword.me
thebgllc.com
Subdomains of the above

Out of scope

Cloudflare, Vercel, Supabase
Third-party services
Parked / inactive domains
DoS / DDoS testing
Social engineering
Physical security
Automated scanner noise

Reporting

How to submit a report

Email security@thebgllc.com

Use the subject line Security: [domain]. Plain text is fine — no need for a special template.

Describe what you found

Include the affected URL or endpoint, the type of vulnerability, steps to reproduce, and your assessment of impact. A proof-of-concept is helpful; a full exploit is not required.

Give me a chance to fix it

Please don't publicly disclose the issue until I've had a reasonable opportunity to address it — or until we've agreed on a coordinated disclosure date.

Ground rules

What I ask of researchers

Only test against your own account or data, or data you have explicit permission to access.
Don't modify, delete, or exfiltrate other users' data to demonstrate a vulnerability.
Don't run automated scanners against production in a way that degrades service.
Don't use a vulnerability to access systems beyond the minimum needed to confirm it.
Report what you find — don't exploit it, sell it, or hold it for leverage.

My commitments

What you can expect

Acknowledgment within 5 business days of your report.
An honest assessment of severity and my plan for the issue.
Fix timelines: critical issues within 14 days where possible; other issues within 30–90 days depending on complexity.
I'll let you know when the issue is resolved, and credit you in the fix if you'd like to be named.
No legal action against researchers acting in good faith within this policy.

There is currently no monetary bounty program. That may change as these products grow.

Safe harbor

Good faith is protected

Security research conducted in accordance with this policy is authorized. I will not pursue legal action against researchers who discover and report vulnerabilities responsibly. If a third party initiates legal action in connection with research you've conducted under this policy, I will make clear that your actions were authorized and taken in good faith.

This policy is not a blanket authorization to probe my infrastructure. It's a commitment to fair dealing when researchers act within the guidelines above.

Contact

Get in touch

Security disclosures

security@thebgllc.com