Security disclosure policy

Last updated: 17 September 2026

How to report a vulnerability

Email privacy@nacar.ai with the subject “Security vulnerability report”. Do not include personal data or confidential customer data.

What to include

• The affected service, URL or component.
• A clear description of the vulnerability and its impact.
• Steps that let us reproduce the issue safely.
• Relevant logs, screenshots or proof-of-concept code.
• Your contact details and preferred disclosure timeline.

Our response

We acknowledge your report within three business days. We send a status update within ten business days, and again each time the status changes.

Safe harbour

We do not pursue legal action for good-faith research that follows this policy. Stop testing when you find a vulnerability. Give us a reasonable time to investigate and fix it. Do not harm users, disrupt services, or access data beyond what is necessary to show the issue.

Out of scope

• Denial-of-service testing.
• Social engineering or phishing.
• Physical attacks.
• Testing of third-party services.
• Automated scanning that degrades the service.
• Any access to real candidate data.

Rewards

We do not operate a bug bounty and do not offer payment.

Coordinated publication

Coordinate publication with us before you disclose the vulnerability. We agree a reasonable publication date after we assess the risk and prepare a fix. We credit you if you ask for credit.