Signup Crew Vulnerability Disclosure Policy

Purpose

Just Walking Ventures, LLC, doing business as Signup Crew (“Signup Crew,” “we,” “us,” or “our”), takes the security of our Platform and the information entrusted to us seriously.

We welcome responsible, good-faith reports from security researchers and others who believe they have identified a potential security vulnerability affecting Signup Crew.

This Vulnerability Disclosure Policy describes how to report a potential vulnerability and establishes the boundaries for good-faith security research involving Signup Crew.

Reporting a Potential Vulnerability

If you believe you have identified a security vulnerability affecting Signup Crew, please email support@signupcrew.com with the subject “Security Report.”

When appropriate and safe to do so, please include:

• The affected Signup Crew URL, feature, or workflow
• A description of the potential vulnerability
• The minimum steps necessary to reproduce the issue
• The likely or observed security impact
• Screenshots or other evidence that do not unnecessarily expose another person's information
• Contact information if you would like us to follow up with you

Please do not include passwords, authentication tokens, full payment-card information, service-provider credentials, or personal information that is unnecessary to explain the vulnerability.

Signup Crew does not promise a specific acknowledgment, response, remediation, or payment timeline through this policy.

Authorized Good-Faith Research

Good-faith security research under this policy must be limited to the minimum activity reasonably necessary to identify and demonstrate a potential vulnerability affecting Signup Crew-owned web application functionality.

If you are unsure whether a system or activity is within the authorized scope, do not test it; report the potential issue without further testing.

When conducting research:

• Use only accounts and information that you own or have express permission to use when authentication is required
• Perform only the minimum testing necessary to demonstrate the potential vulnerability
• Do not access, modify, download, retain, or disclose information belonging to another customer, volunteer, RSVP participant, or user
• If you unexpectedly encounter another person's information, stop testing, avoid further access or retention, and report the issue promptly
• Do not conduct destructive testing or take actions that could alter or delete information
• Do not conduct denial-of-service, load, stress, or other availability testing
• Do not send spam or bulk communications or engage in mass account creation
• Do not use social engineering, phishing, physical attacks, or impersonation
• Do not deploy malware or attempt to establish persistent access
• Do not attempt to obtain passwords, authentication tokens, service-provider credentials, secrets, or other credentials
• Do not attempt to bypass this policy's limitations or use this policy as authorization for activity outside its stated scope

This policy does not authorize unrestricted testing of Signup Crew systems or environments.

Third-Party Systems Are Out of Scope

This policy does not authorize testing of infrastructure, accounts, products, or services operated by third parties, including Supabase, Stripe, Resend, Vercel, Google, or other Signup Crew service providers.

Those providers maintain their own systems, security controls, terms, and vulnerability disclosure practices.

If you believe a vulnerability involves Signup Crew's integration with a third-party provider, please report the potential impact to Signup Crew without testing the provider's infrastructure, attempting to access provider credentials, or exceeding the scope authorized by this policy.

Protecting Other Users and Their Information

Security research must respect the privacy and security of Signup Crew customers, volunteers, RSVP participants, users, and Organizations.

If you inadvertently encounter information that does not belong to you:

1. Stop accessing the information.
2. Do not copy, download, retain, share, or otherwise use the information beyond what is minimally necessary to report the issue.
3. Notify Signup Crew promptly.
4. Follow reasonable instructions provided by Signup Crew concerning protection or deletion of information obtained inadvertently.

This policy does not authorize access to another person's account or information.

Disclosure Coordination

We ask researchers to provide Signup Crew with a reasonable opportunity to investigate and address a reported vulnerability before publicly disclosing it.

The appropriate period may depend on the nature and severity of the issue, potential risks to users, complexity of remediation, and applicable legal requirements.

This policy does not establish a fixed disclosure embargo or guarantee an acknowledgment, response, remediation timeline, bug bounty, reward, fee, or payment.

Good-Faith Research and Safe Harbor

Subject to applicable law, Signup Crew does not intend to pursue legal action against a security researcher for good-faith security research that is conducted in accordance with this Vulnerability Disclosure Policy and remains within its authorized scope.

This safe harbor is conditional and does not provide blanket authorization for unrestricted testing.

It does not apply to activities outside this policy, including unauthorized access to another person's information, destructive or disruptive testing, attacks against third-party systems, extortion, intentional privacy violations, or other conduct prohibited by applicable law.

Nothing in this policy authorizes activity that would violate applicable law or grants permission on behalf of a third party.

No Bug Bounty or Compensation Program

Signup Crew does not currently operate a bug bounty program.

Submitting a vulnerability report does not create an entitlement to payment, compensation, reward, employment, or any other benefit.

We appreciate responsible reports that help us improve the security of Signup Crew.

Changes to This Policy

We may update this Vulnerability Disclosure Policy as Signup Crew, our security practices, and the Platform evolve.

The effective date shown above identifies the version of this policy then in effect. Security research is governed by the policy in effect at the time the research occurs.

Contact Us

To report a potential security vulnerability involving Signup Crew:

Just Walking Ventures, LLC
Doing business as Signup Crew
Email: support@signupcrew.com
Subject: Security Report