Responsible Disclosure Policy
Effective July 17, 2026 · v1.1.0.
We welcome security researchers who help keep AutoSAM and our users safe.
1. Scope
In-scope:
• The AutoSAM marketing website at autosam.io and *.autosam.io
• AutoSAM API endpoints, once available
• Authentication and authorization mechanisms
• Data exposure or leakage vulnerabilities
• Cross-site scripting (XSS), SQL injection, CSRF
• Server-side request forgery (SSRF)
• Business logic flaws affecting data integrity or access control
Out-of-scope:
• Third-party services not operated by GovCertix LLC
• Social engineering or phishing attacks against employees or users
• Denial-of-service (DoS/DDoS) attacks
• Physical security testing
• Automated vulnerability scanning that generates excessive traffic
• Accessing, modifying, or deleting data belonging to other users
• Findings from applications or services not listed in-scope
2. How to Report
Please send vulnerability reports to security@autosam.io. AutoSAM does not currently publish a PGP public key; no corresponding Encryption directive appears in our security.txt file. If you need to encrypt a sensitive report before a key is published, email security@autosam.io first to coordinate a secure channel.
In your report, please include:
• A detailed description of the vulnerability
• Steps to reproduce (including URLs, parameters, payloads)
• The potential impact of the vulnerability
• Any proof-of-concept code or screenshots
• Your contact information for follow-up
3. What to Expect
AutoSAM is currently operated by a small, solo-operator team. We take every report seriously and commit to the following, with reasonable flexibility for the reasons noted:
• Acknowledgment: We will confirm receipt of your report within 5 business days
• Status updates: We will provide status updates at reasonable intervals during triage and remediation, and at minimum every 30 days on open reports
• Coordinated disclosure: We follow a 90-day coordinated disclosure default. We ask that you do not publicly disclose the vulnerability until we have had 90 days to investigate and remediate, or until we confirm the issue is resolved, whichever comes first. If remediation genuinely requires longer, we will communicate the reason and a revised timeline before day 90, and work with you on any adjustment
• Credit: With your permission, we will publicly credit you for the discovery on our security acknowledgments page. AutoSAM does not currently offer monetary bounties; we may offer credit and, at our discretion, non-monetary tokens of appreciation
4. Safe Harbor
GovCertix LLC considers security research conducted consistent with this policy to be authorized and will not pursue legal action against researchers who:
• Act in good faith to avoid privacy violations, data destruction, and disruption to our services
• Only interact with accounts they own or have explicit written permission to test
• Do not exploit a vulnerability beyond what is necessary to confirm it exists
• Report the vulnerability promptly and do not disclose it publicly before resolution
• Comply with all applicable laws
We consider activities conducted consistent with this policy authorized under the Computer Fraud and Abuse Act (CFAA) and analogous state laws, and we will not report you to law enforcement for such activities. Third-party claims are outside our control; if legal action is initiated by a third party against you for activities conducted in accordance with this policy, we will take reasonable steps to make it known that your actions were authorized under this safe harbor provision, and we encourage you to consult your own counsel.
5. Legal Boundaries
The following activities are strictly prohibited and are not covered under this policy or its safe harbor:
• Accessing, modifying, or deleting data belonging to other users
• Executing or attempting denial-of-service attacks
• Sending unsolicited messages or social engineering attacks
• Testing third-party services, applications, or websites not owned by GovCertix LLC
• Any activity that violates applicable local, state, or federal law
6. Contact
For all security-related inquiries, contact:
GovCertix LLC
2461 Eisenhower Ave, Suite 200
Alexandria, VA 22314
security@autosam.io
This is the same address published in our security.txt file per RFC 9116.
Effective July 17, 2026 · v1.1.0.
This document: v1.1.0; last reviewed July 17, 2026.