Responsible Disclosure
We welcome good-faith reports that help protect SiteAirbag customers and visitors. This policy is not a bug-bounty offer or a promise of legal immunity.
Effective date: 18 oct 2026How to report
Email security@siteairbag.com with a concise description, affected URL or feature, impact, reproducible steps and any safe proof. Remove credentials, personal data and other customers' information. We will triage reports according to verified impact and available staffing; no fixed response or resolution SLA is promised.
Safe research boundaries
Use only accounts, workspaces, domains and data you own or have explicit permission to test. Stop if you encounter another person's data; do not extract, retain or disclose more than is strictly necessary. Do not establish persistence. Do not use availability attacks, destructive testing, malware, phishing, social engineering, credential attacks, spam, physical intrusion, third-party or customer infrastructure testing, or automated traffic that risks availability.
What to expect
We may ask for clarification, reproduce the issue, coordinate a remediation window and credit a reporter only with mutual consent. Duplicate, informational, theoretical or out-of-scope reports may be closed without action. No payment is promised. Do not publicly disclose an unresolved issue until we have had a reasonable opportunity to investigate and reduce risk.
Emergencies and abuse
For an active compromise, exposed secret or unauthorized monitoring deployment, put URGENT SECURITY in the subject. Do not send the secret itself when a location or revocation identifier is sufficient. Product support, privacy requests and billing questions should use their dedicated contacts.
Questions or requests
Support: support@siteairbag.com
Privacy: privacy@siteairbag.com
Security: security@siteairbag.com
Legal: legal@siteairbag.com