Vulnerability Disclosure Policy

Last updated: October 13, 2026

We welcome reports from security researchers that help keep Adaptwise and our users safe.

Scope

In scope:

• adaptwise.io, adaptwise.dev, adaptwise.app, getadaptwise.com
• Adaptwise Scan
• Adaptwise software we release, such as the CLI, plugin and open skills, once published

Out of scope:

• Third-party services we use. Report those to the vendor.
• Denial-of-service testing, spam and social engineering.
• Physical attacks.
• Findings that only affect outdated browsers.

How to report

Email security@adaptwise.io with:

• a short summary and the affected URL or component
• steps to reproduce, or a proof of concept
• the potential impact, and your estimate of its severity
• the browser, operating system or tool version you used

Please don't include other people's personal data. If your report needs to include tokens, logs or other sensitive data, email us first and we'll agree on a secure way to send it.

Usually not eligible

We're glad to hear about anything that worries you, but these reports usually don't need a fix unless you can show a real impact:

• missing security headers, or clickjacking, on pages with no sensitive actions
• email setup (SPF, DKIM, DMARC) on domains that don't send mail
• self-XSS, or issues that need physical access to a victim's device
• the absence of rate limits, without a demonstrated abuse
• version banners or software versions, without a working exploit
• reports produced only by automated scanners, without verification

What we ask

• Give us reasonable time to fix the issue before disclosing it publicly. We suggest 90 days, or sooner by agreement once it's fixed.
• Test only against your own data and accounts. Don't access, change or keep other people's data. Stop and tell us if you encounter it.
• Don't degrade the Services, and don't use automated scanning at volumes that affect availability.

What we commit to

• Acknowledge your report within 5 business days and keep you updated.
• Fix confirmed issues in a time frame that matches their severity.
• Credit you publicly if you want.
• Not pursue legal action for good-faith research that follows this policy. For activity within this policy's scope, it overrides the acceptable-use restrictions in our Terms of Use.

We don't currently offer a paid bug bounty.

Our own reporting obligations

Where the law requires it, for example under the EU Cyber Resilience Act for products we place on the EU market, we will report actively exploited vulnerabilities and severe incidents to the relevant authorities within the required time frames, and inform affected users.