Quartr Vulnerability Disclosure Policy

Our CommitmentQuartr values the work of independent security researchers in helping us keep our products and our customers' data safe. This policy describes how to report a security vulnerability to us, what you can expect from us in response, and the ground rules for responsible disclosure.

Scope

This policy applies to:

All Quartr production applications and services (web.quartr.com, api.quartr.com, mcp.quartr.com, and related subdomains)
Quartr-owned mobile applications

Out of scope:

Third-party services we integrate with but do not operate (report those to the respective vendor)
Denial-of-service, spam, or social engineering attacks against our staff
Physical security of our offices
Findings requiring physical access to a user's device
Automated scanner output without a demonstrated, exploitable impact

How to Report

Email security@quartr.com with:

A clear description of the vulnerability and its potential impact
Step-by-step reproduction instructions or a proof-of-concept
Affected URL(s), endpoint(s), or component(s)
Any relevant screenshots, logs, or request/response captures

Please do not include live exploit payloads against production data beyond what is strictly necessary to demonstrate the issue, and do not access, modify, or exfiltrate other user's data.

What You Can Expect From Us

Milestone	Timeline
Acknowledgment of report	Within 2 business days
Initial triage / severity assessment	Within 5 business days
Status updates	At least every 10 business days until resolution
Remediation of critical/high issues	Best effort, prioritized by severity

We will keep you informed of progress and will notify you once the issue is resolved or when we determine a report is out of scope / not reproducible, with an explanation.

Safe Harbor

If you make a good-faith effort to comply with this policy during your research, we will:

Not pursue legal action against you for your research
Work with you to understand and resolve the issue quickly
Not report your research to law enforcement, provided you have not acted in bad faith

Good faith means, at minimum: no data exfiltration beyond proof-of-concept, no service disruption, no access to accounts you don't own, and prompt, private reporting to us before any public disclosure.

Recognition

Quartr does not currently offer paid bounties. Depending on severity and quality of the report, we may offer:

Public acknowledgment (with your permission) on a security acknowledgments page
Quartr swag
At our discretion, a discretionary reward for critical, high-impact findings

(Note: this program may evolve to include structured paid bounties in the future.)

Coordinated Disclosure

We ask that you give us a reasonable amount of time to investigate and remediate an issue before any public disclosure (typically 90 days, extendable by mutual agreement for complex issues). We're happy to coordinate a joint disclosure timeline with you.

Thank You

We're grateful to researchers who take the time to report issues responsibly. Your work helps keep Quartr and our customers safe.