Vulnerability Disclosure Policy

Effective date: November 3, 2026

How to report

Email alerts@initialeyes.com with a description of the issue, the steps to reproduce it, and the impact you believe it has. Please don't put customer data or secrets in the report; describe them instead. Our machine-readable contact file is at /.well-known/security.txt.

Scope

• In scope: the InitialEyes web application at initialeyes.com.
• Out of scope: denial-of-service or load testing; social engineering or phishing; physical attacks; automated high-volume scanning; and services run by third parties we use, such as our payment provider Paddle, our hosting provider, and our newsletter platform. Report issues in those to the provider directly.

Rules for testing

• Use only accounts and data that are your own. Stop and report as soon as you can see data that isn't yours, and don't keep, copy or share it.
• Don't degrade the service for other people, and don't submit forms in volume.
• Keep the details private until the issue is fixed, or until 90 days after your report, whichever comes first, unless we agree otherwise.

What you can expect from us

• We aim to acknowledge your report within 5 business days and to keep you told what we're doing about it.
• We will not take legal action against, or ask law enforcement to investigate, anyone who makes a good-faith report and follows this policy.
• With your permission, we'll credit you once the issue is fixed.

InitialEyes is run by a small team, so please be patient with response times.