Security & Responsible Disclosure

QorTrace is a cryptographic-risk product, so we hold ourselves to a high security bar. We welcome reports from the security community and commit to working in good faith with researchers who help us keep QorTrace safe.

1. Reporting a vulnerability

Email security@qortrace.com with a clear write-up of the issue, reproduction steps, affected URLs or endpoints, and any proof-of-concept code. Encrypt sensitive details with our PGP key:

• PGP fingerprint: available on request — email security@qortrace.com and we'll send our latest public key over a side-channel for coordinated-disclosure traffic.
• security.txt (RFC 9116): https://qortrace.com/.well-known/security.txt

We acknowledge reports within 2 business days and provide a triage decision within 5 business days.

2. Safe harbor

We will not pursue civil or criminal action against researchers who:

• Make a good-faith effort to comply with this policy.
• Avoid privacy violations, destruction of data, or interruption / degradation of the Service.
• Only interact with accounts they own or have explicit permission from the account holder to access.
• Stop testing as soon as the vulnerability is identified and provide us a reasonable time to remediate before public disclosure.

3. In scope

• The QorTrace web application at qortrace.com and *.qortrace.com.
• The QorTrace API at api.qortrace.com and qortrace.com/api.
• Customer-facing audit certificates and verification endpoints.

4. Out of scope

• Findings that require physical access, social engineering of QorTrace staff, or denial-of-service techniques.
• Reports based solely on automated scanner output without a working proof-of-concept.
• Best-practice configuration suggestions without a concrete impact (e.g. missing HSTS preload, weak ciphers in non-customer-facing internal tooling).
• Vulnerabilities in third-party services (Stripe, Cloudflare, Resend, etc.) — please report those directly to those providers.
• Spam, content-injection, or self-XSS that requires the victim to paste attacker-controlled code into devtools.

5. What we ask you NOT to do

• Do not access, modify, or delete data that does not belong to you.
• Do not run automated load tests, scraping at scale, or fuzzing against production.
• Do not publicly disclose findings before we’ve remediated.

6. Recognition

With your permission, we publicly credit researchers who report valid, in-scope issues on a hall-of-fame page after remediation. QorTrace does not currently operate a paid bug-bounty program but we may award discretionary bounties or merch for impactful reports.

7. PGP & security.txt

Our /.well-known/security.txt will be published at launch and will reference the canonical contact channel. If you find a discrepancy between this page and security.txt, the latter is authoritative.

8. Contact

Reports: security@qortrace.com
Privacy: privacy@qortrace.com
Press & partnerships: press@qortrace.com