On this page
1. Testing scope
This reporting route covers suspected vulnerabilities in JOIN SHEET’s website and application. It does not authorize tests of Google, Paddle, Supabase, Vercel, Cloudflare, or systems belonging to other people. Follow each provider’s own reporting policy for their systems.
2. What to include
Email contact@joinsheet.com with “[Security]” in the subject. Do not attach confidential spreadsheets or include another person’s personal data.
- Affected URL, feature, browser, and version.
- Clear reproduction steps and the observed security impact.
- A minimal proof of concept using your own test data.
- Whether you believe exploitation is active and a safe way to contact you.
3. Good-faith testing rules
- Use only accounts, devices, and data you own or are authorized to test.
- Stop immediately if you encounter another person’s data and report what happened without retaining or sharing it.
- Do not perform denial of service, destructive testing, social engineering, spam, automated high-volume scanning, physical testing, or attempts against third-party systems.
- Do not demand payment or threaten disclosure. Allow a reasonable period for investigation and coordinated remediation.
4. Our response
We aim to acknowledge a credible report within two business days, assess its priority, request clarification if needed, and provide significant updates when practical. These are operational goals, not a guaranteed service-level agreement or a promise of a specific fix date.
We will not pursue legal action solely for good-faith research that follows this policy, avoids privacy harm and service disruption, and complies with applicable law. This statement does not bind a third party.
5. Disclosure and credit
Coordinate public disclosure with us so users can be protected. We may ask for additional time where a fix, provider coordination, or user migration is reasonably required.
There is no paid bug-bounty program. With your permission, we may recognize a helpful report after remediation, but cannot promise public credit.
6. Out of scope
Use the relevant Support page for feature requests, unsupported-file errors, pricing questions, and privacy requests. Reports of a missing recommended security header may receive lower priority if they do not demonstrate a risk.