Responsible Disclosure

How to Report a Vulnerability

We welcome reports of security issues in any ERIN product, website or service. Email responsible.disclosure@erinapp.com with:

• The affected URL, endpoint or feature
• A description of the issue and its impact
• Steps to reproduce it, ideally with a proof of concept
• Any suggested fix
• Any plans you have for public disclosure

Clear reports in English with a working proof of concept are triaged fastest. Every report is handled under the rules on this page.

Who Can Report

You need to be 18 or older and follow the rules here. ERIN employees and contractors can't take part, and neither can people in countries under U.S. sanctions. Please send reports to responsible.disclosure@erinapp.com rather than messaging ERIN staff or customers directly, since going around that channel can make a report ineligible. We can change or close this program at any time.

Scope

In scope

• ERIN web applications and APIs hosted on erinapp.com and its subdomains
• Customer-branded referral sites operated by ERIN, subject to the testing rules below

Out of scope

• Third-party services we use, such as AWS, Supabase, OpenAI or HubSpot. Please report those to the vendor.
• Marketing website content with no access to customer data
• Denial of service, load or volumetric testing
• Social engineering, phishing, spam or physical testing of ERIN staff, offices or customers
• Automated scanner output without a working proof of concept or a demonstrated security impact
• Best-practice recommendations without a demonstrated exploit, such as missing security headers, SPF, DKIM or DMARC configuration, clickjacking on pages without sensitive actions, or software version disclosure

Testing Rules

• Use only accounts you own or that we provide. Email us to request a test company.
• Do not access, change, download or keep data that belongs to anyone else. If you come across personal data or another company's data, stop, don't use or share it, and tell us right away.
• On customer-branded referral sites, do only what is needed to confirm an issue exists. Don't test further without our written permission.
• Don't disrupt or degrade service for ERIN or our customers, and don't use malware or anything that could harm users.
• Don't break the law or infringe anyone else's rights.

What to Expect From Us

• A reply within 2 business days
• An expected remediation timeline after we triage your report, with updates as we work on it
• An open line to discuss the issue
• A note when the issue is fixed

Recognition and Rewards

ERIN doesn't run a paid bug bounty. When you report a valid, previously unknown vulnerability and we fix it, we'll ask whether you'd like to be credited, and we'll gladly thank you for the help.

We may also send a thank-you gift for a report with real security impact. It's our call and it's never guaranteed. Duplicates, out-of-scope reports, automated scanner output and reports that break these rules aren't eligible, and we won't pay anyone to send us details. If we do send something, you're responsible for any tax on it, and we may need a few details from you in order to send it.

Safe Harbor

If you make a good-faith effort to follow this page, we'll consider your research authorized and won't take legal action against you for it. If someone else takes legal action over research that followed these rules, we'll tell them your work was authorized.

Coordinated Disclosure

Please give us at least 90 days from your report to investigate and fix an issue before you share it publicly, or less if we confirm the fix sooner. We'll work with you on timing and on what details are disclosed.

Final Notes

Reporting to us is voluntary. We're grateful for good-faith research, but we can't accept responsibility for losses or damage that come from taking part.

Last updated: October 30, 2026