Security Vulnerability Disclosure Policy

We welcome good-faith reports of security vulnerabilities in our systems to security@unidal.tech. We offer safe harbor for non-destructive security research conducted in accordance with this policy.

Ground rules

• Do not test against real client data or the live survey submission store.
• Do not perform denial-of-service testing.
• Report findings privately and give us a reasonable time to remediate before any public disclosure.

What to expect from us

• We acknowledge reports within 2 business days.
• We remediate according to severity: critical issues within 48 hours, high within 7 days, medium within 30 days, and low in our next scheduled release.
• We credit reporters who wish to be credited, once a fix has shipped.

Machine-readable contact

See /.well-known/security.txt (RFC 9116) for the current contact address and expiry date.