Vulnerability Disclosure Policy
Last Updated: August 16, 2026
At 4leggedIT, our mission is to empower animal rescues, shelters, foster-based organizations, and other dog-related organizations and businesses we support with reliable, secure, and modern technology.
Every dollar and volunteer hour saved through efficient technology can help translate into more animals being fed, treated, fostered, and rehomed.
We welcome responsible security research that helps us identify and fix vulnerabilities in the technology we manage and maintain.
Because 4leggedIT operates as a mission-driven technology initiative with lean resources, we do not offer monetary bug bounties, cash rewards, or other financial compensation for vulnerability disclosures. We do, however, value the ethical security community and, with a researcher's permission, may publicly recognize individuals who help us improve the security of our infrastructure and supported organizations.
Quick Path
- Test only what's in scope, minimize impact, and report privately before disclosing.
- Report to [email protected] with steps to reproduce and a PoC when possible.
- No cash bounties — with permission, we credit researchers on our Security Hall of Fame.
1. Safe Harbor & Good Faith
If you make a good-faith effort to comply with this policy during security research, we will consider your research authorized only for systems and components that are within the scope described below and that 4leggedIT has authority to manage or maintain.
We will not knowingly pursue legal action against researchers for security research conducted in good faith and consistent with this policy.
To remain within safe harbor, you must:
Respect Privacy: Do not intentionally access, download, modify, disclose, or exfiltrate donor information, volunteer or adopter personal information, animal records, credentials, or other sensitive data.
If you accidentally encounter sensitive information, stop testing that portion of the system immediately, do not copy or further access the information, and notify us as part of your report. Delete any incidental local copies as soon as reasonably possible.
Minimize Impact: Limit testing to the minimum activity necessary to demonstrate the vulnerability. Do not perform Denial of Service (DoS/DDoS), resource-exhaustion attacks, brute-force attacks, or automated testing that could degrade services.
Maintain Confidentiality: Do not publicly disclose vulnerability details, sensitive information, credentials, or exploit code relating to a reported issue until 4leggedIT has had a reasonable opportunity to investigate and remediate the issue.
No Social Engineering: Do not engage in phishing, social engineering, impersonation, physical intrusion, or attacks against volunteers, staff, donors, adopters, foster homes, rescue partners, or other individuals.
Do Not Access Third-Party Systems: This policy does not grant permission to test systems owned or operated by third parties. This includes independent infrastructure operated by supported organizations, hosting providers, SaaS platforms, donor systems, animal listing services, email platforms, and other external services.
2. Scope
In-Scope
Security testing is permitted against technology that is owned, hosted, developed, or directly maintained by 4leggedIT, including:
4leggedIT Infrastructure
*.4leggedit.com- Websites, applications, APIs, forms, scripts, and infrastructure directly managed by 4leggedIT
Supported Organizations & Websites
A website for a rescue, shelter, or other organization or business 4leggedIT supports may be considered in scope only to the extent that 4leggedIT directly manages, develops, hosts, or maintains the affected technology.
Examples may include:
thecomebackpack.orgthemisfitranch.comroversreturndogrescue.org- Other websites or properties explicitly identified by 4leggedIT as being covered by this policy
Managed APIs & Integrations
- API endpoints directly developed or maintained by 4leggedIT
- Custom web forms and applications developed by 4leggedIT
- Custom integrations, scripts, or other technology components developed or maintained by 4leggedIT
- Administrative interfaces directly operated by 4leggedIT
How to Verify Scope
A website may link to this policy through its /.well-known/security.txt file as an indication that 4leggedIT provides security-reporting assistance for that property.
However, the presence of this policy in a website's security.txt file does not authorize testing of third-party systems or components that 4leggedIT does not control or maintain.
When in doubt, report the potential vulnerability to [email protected] rather than continuing testing.
Out of Scope
The following are outside the scope of this policy:
- Physical attacks or physical access to rescue shelters, sanctuaries, offices, volunteer locations, or hardware
- Social engineering, phishing, or impersonation of volunteers, donors, adopters, foster homes, staff, or rescue partners
- Volumetric resource exhaustion or Denial of Service (DoS/DDoS)
- Spam or actions intended to generate unwanted communications
- Third-party platforms or SaaS services independently managed by the organizations we support
- Petfinder, Adopt-a-Pet, Chewy Shelter and Rescue Network, Google Workspace, and similar third-party services
- Hosting providers, registrars, payment processors, donor-management systems, and other external infrastructure
- Vulnerabilities that exist solely within a third-party service and are not caused by a custom component, integration, configuration, or implementation created or maintained by 4leggedIT
If a vulnerability involves a third-party service but appears to originate from a custom component or integration created by 4leggedIT, please report it to us.
3. Reporting a Vulnerability
To report a potential vulnerability affecting a system within the scope of this policy:
Email: [email protected]
Please include:
- The affected domain, website, or application
- The specific URL, endpoint, or component affected
- Clear steps to reproduce the issue
- A minimal Proof of Concept (PoC), when appropriate
- The potential security impact
- Any relevant screenshots or supporting information
Please avoid including sensitive personal information or credentials in your report unless absolutely necessary to demonstrate the vulnerability.
PGP / Encryption
If you need to submit particularly sensitive information, you may request our PGP public key before sending the report.
4. Response Targets
We take vulnerability reports seriously and aim to meet the following response targets:
| Action | Target |
|---|---|
| Initial acknowledgment | Within 3 business days |
| Initial triage and validation | Within 7 business days |
| Remediation or status update | Based on severity and complexity |
| Ongoing updates | Approximately every 14 days for active issues |
These are response targets rather than contractual service-level agreements. Complex vulnerabilities, third-party dependencies, or issues requiring coordination with a partner organization may require additional time.
5. Rewards & Recognition
Monetary Compensation
4leggedIT does not offer monetary bug bounties, cash rewards, financial rewards, or other monetary compensation for vulnerability disclosures.
Public Recognition
With the researcher's permission, we may publicly recognize your report on the 4leggedIT Security Hall of Fame page. Validated vulnerabilities are listed in Our Hall of Fame; reports that reflect valuable good-faith testing but don't rise to a confirmed vulnerability may instead be recognized under Security Contributions.
Researchers may choose to be recognized by name, organization, website, or another attribution of their choice. Anonymous recognition is also available.
Our goal is simple: make the technology we support safer for everyone.
Attribution & Credit
Credit is awarded only to the researcher(s) who actively participated in the discovery and submission of the vulnerability. We do not permit the transfer, trading, or swapping of credit to third parties who were not involved in the original research.
Thank you for helping us protect the organizations, volunteers, adopters, donors, and animals who depend on it.