Security & Responsible Disclosure

Send vulnerability reports to security@spadebrite.com. Please include a clear description, reproduction steps, and any proof-of-concept material necessary to validate the issue. We support PGP for sensitive reports on request.

In scope:

• the SpadeBrite website and product surfaces;
• API endpoints documented in our developer materials;
• authentication, authorization, and account-management flows.

Out of scope:

• denial-of-service or volumetric testing;
• social engineering, physical attacks, or attacks on third-party services;
• findings produced by automated scanners without demonstrated impact.

We will not pursue legal action against researchers acting in good faith who follow this policy, avoid privacy violations, destroy any retrieved data, and give us reasonable time to remediate before public disclosure.

We aim to acknowledge reports within five business days, communicate a tentative remediation timeline, and credit researchers (with permission) once an issue is resolved.