Responsible Disclosure

1. Reporting a Concern

We appreciate good-faith reports that help protect App Intelligence systems and users. Send a concise report to build@appintelligence.ca with the subject line “Security Disclosure.”

Include the affected URL or system, a description of the issue, reproducible steps, expected and observed behaviour, potential impact, and any supporting screenshots or logs that do not expose unnecessary personal or confidential information.

2. Reporting and Testing Permission

We welcome reports based on information available to the public, such as published DNS records or issues noticed during ordinary use of our website.

Before running vulnerability scans, probing endpoints, or submitting test payloads through live forms, email build@appintelligence.ca and obtain written permission. Any permission applies only to the systems, methods, and dates specified in the written approval.

Avoid spam, social engineering, credential attacks, malware, service disruption, and activity that could expose private data or harm users. If you encounter sensitive information, stop and report it privately.

3. Protecting Information

Stop testing and notify us promptly if you encounter personal information, credentials, confidential client information, or data that does not belong to you.

Do not copy, retain, alter, download, transmit, or publicly disclose such information except for the minimum evidence required in the private report.

4. What to Expect

We will make a reasonable effort to acknowledge a credible report, investigate the concern, request clarification when needed, and communicate when appropriate.

Response and remediation time will depend on severity, complexity, ownership of the affected system, third-party involvement, and available resources. This policy does not create a promise of payment, employment, reward, or a specific response deadline.

5. Public Disclosure

Give us a reasonable opportunity to investigate and address the issue before any public disclosure. Coordinate disclosure timing with us and avoid publishing information that could enable abuse or expose users.

6. Scope Limitations

This page does not authorize testing of client-controlled systems, third-party services, production accounts, vendor infrastructure, or systems that App Intelligence does not own or operate.

When a concern affects a third party, report it to the appropriate owner.

7. Safe-Harbour Limitation

App Intelligence intends to respond constructively to good-faith research that follows this policy. However, this page is not legal advice, does not bind third parties, and does not authorize conduct that violates applicable law or another party’s rights.