Responsible Disclosure Policy

Effective: October 24, 2026

1. Purpose

We welcome reports from security researchers and customers who find a vulnerability in AccountMade. This Policy explains how to report one, what testing is permitted, and how we respond. It is published as the Policy in our security.txt. Our general control approach is described in the Security Overview.

2. How to report

Email hello@accountmade.com with subject Security report: AccountMade and include:

• the affected URL, endpoint, or component;
• the type of issue and its likely impact;
• step-by-step reproduction instructions;
• a safe proof of concept (screenshots, requests, or a short video); and
• how you would like to be credited, if at all.

Write in English. Do not include other people's personal data or Customer Content in your report; describe it instead.

3. Scope

In scope:

• accountmade.com and its subpaths, including the signed-in application at /app;
• AccountMade APIs served from accountmade.com; and
• public and buyer links generated by AccountMade.

Out of scope:

• third-party services we use (see Subprocessors); report those to the vendor;
• customer systems connected to AccountMade, such as a CRM or document store;
• denial-of-service, load or volumetric testing;
• social engineering, phishing, or physical attacks against our staff or providers;
• spam or rate-limit findings without a demonstrated security impact; and
• reports from automated scanners without a working proof of concept.

4. Rules for testing

• Use only accounts you created yourself, and test only against data you own.
• Do not access, modify, download, or delete another customer's data. If you reach it by accident, stop, do not keep it, and tell us in your report.
• Do not disrupt the service, degrade performance for others, or persist access.
• Do not use a finding to demand payment or any other benefit.
• Give us a reasonable opportunity to fix the issue before telling anyone else.

5. What to expect

Our first-reply target is one business day, Monday to Friday, Korea Standard Time, excluding Korean public holidays. We will confirm whether we can reproduce the issue, tell you what we plan to do, and let you know when it is fixed. We may ask for more detail. We will coordinate any public disclosure with you once a fix is live.

6. Safe harbor

If you make a good-faith effort to follow this Policy, we will treat your research as authorized, will not pursue or support legal action against you for it, and will work with you to understand and fix the issue. This does not authorize access to third-party systems or data, and it does not override a law or a court order.

7. Rewards

We do not currently operate a paid bug-bounty program, and we do not pay for reports. We are glad to thank researchers publicly.

8. Contact

Security reports: hello@accountmade.com

Acknowledgments

With your permission, we list researchers who reported a valid issue under this Policy here. No reports have been acknowledged yet.