Responsible disclosure policy

Last updated: 7 August 2026.

We welcome good-faith security research into SortedResearch. If you believe you have found a vulnerability, we want to hear about it, and we commit to working with you throughout.

How to report

Email security@sortedresearch.com with:

A description of the issue and its potential impact.
Steps to reproduce (a proof of concept is ideal).
The URL, endpoint, or component affected.
Your contact details if you would like updates or credit.

We will acknowledge your report within 3 business days, keep you informed as we investigate, and tell you when the issue is resolved.

Scope

In scope:

sortedresearch.com and its subdomains: the researcher console, participant study pages, APIs, and marketing pages.

Out of scope:

Denial-of-service or volumetric attacks.
Social engineering, phishing, or physical attacks against our team or providers.
Automated scanning that degrades service for others.
Vulnerabilities in third-party services (Supabase, Vercel, Stripe, Anthropic, Resend, Cloudflare, PureSpectrum). Please report those to the vendor directly.
Findings that require a compromised device or non-default browser configuration.
Missing best-practice headers or configuration without a demonstrable security impact.

Ground rules (safe harbor)

If you make a good-faith effort to comply with this policy while researching, we will consider your research authorized, will not initiate legal action against you, and will not report you to law enforcement for the research itself. Please:

Do not access, modify, or delete data that is not yours. Use your own test accounts and studies.
Stop and report immediately if you encounter personal data that is not yours.
Do not degrade the service for other users.
Give us a reasonable opportunity to fix the issue before public disclosure. We ask for 90 days, and we will work with you on coordinated disclosure.

Recognition

We do not currently run a paid bug bounty program. With your permission, we are glad to credit meaningful reports publicly on this page once the issue is fixed.

Not a security issue?

For account problems or general bugs, contact support@sortedresearch.com. For privacy questions or data-subject requests, contact privacy@sortedresearch.com.