Vulnerability Disclosure Policy

Effective date: 2026-09-05.

NextCommitHQ wants to know about security problems in NextCommitHQ Network before anyone else does. This policy tells security researchers how to report an issue, what testing is welcome, and what to expect from us. It is also published in machine-readable form at /.well-known/security.txt.

1. How to report

Email security@nextcommithq.com with:

• A description of the issue and the harm it could cause.
• Steps to reproduce, including URLs, request details, and any proof-of-concept.
• The accounts you used (create your own test accounts; do not use other people's).
• Whether you want to be credited, and how to reach you.

We acknowledge reports within 3 business days, give an initial assessment within 10 business days, and keep you informed until the issue is resolved. We do not currently run a paid bug bounty. We will credit you on request once a fix is live.

2. Scope

In scope: the Network's web application and its API routes on the production domain, and the sign-in integration as it appears in our pages.

Out of scope, please report these to the provider concerned instead:

• Our hosting, database, sign-in, and email providers' own infrastructure (see Service Providers).
• Social engineering of our staff or users, physical attacks, and denial-of-service testing.
• Findings from automated scanners without a demonstrated impact, missing best-practice headers with no exploit path, and reports about email spoofing where our domain records already restrict it.

3. Rules of engagement

While researching, please:

• Use only accounts you created. Never access, modify, or delete another person's data. If you reach data that is not yours, stop, record the minimum needed to show the issue, and report it.
• Do not run denial-of-service, brute-force, or volume testing. Our rate limits are part of the product; testing that they exist is fine, exhausting them is not.
• Do not use the Network's messaging, feedback, or report tools to test against real users.
• Do not exfiltrate data, install persistence, or pivot to other systems.
• Give us a reasonable time to fix the issue before any public disclosure. We aim to fix high-severity issues within 30 days and will agree on a disclosure date with you.

4. Safe harbor

If you make a good-faith effort to follow this policy, we will not pursue legal action against you for your research, will not refer it to law enforcement, and will work with you to understand and resolve the issue. This applies to actions within scope and consistent with the rules above. It does not authorize actions against third parties, and it does not apply where you access or use personal data beyond what is needed to demonstrate the issue.

5. What we already do

For context, the Network is built with: authorization on every request enforced in the application and again by row-level security in the database; a least-privilege database role; a per-request content security policy with nonces; HSTS and standard security headers; origin validation on mutations; parameterized queries and validated inputs; idempotent sends and locked acceptances to prevent races; rate limits per user, organization, and recipient; an append-only audit trail; secret scanning and dependency audits in continuous integration; and a managed sign-in provider so we never handle passwords. We describe these to help you focus, not to claim that no problems remain.

6. Incidents affecting users

If you are a user and you believe your account has been accessed without permission, email security@nextcommithq.com at once. If an incident affects your personal information we will notify you as described in the Privacy Policy.

7. Contact

security@nextcommithq.com. Encrypted reporting details will be added to /.well-known/security.txt when a key is published.