Responsible Disclosure Policy

This policy applies to vulnerabilities found in: • phirise.com and all subdomains • Phirise mobile and web applications • Phirise API endpoints • Open-source repositories published by Phirise

Please send vulnerability reports to security@phirise.com. Include as much detail as possible: • A clear description of the vulnerability and its potential impact • Step-by-step instructions to reproduce the issue • Affected URL(s), endpoint(s), or component(s) • Any proof-of-concept code, screenshots, or HTTP request/response logs • Your preferred contact information for follow-up

• Acknowledgment: We will acknowledge receipt of your report within 2 business days. • Triage: We will investigate and assess the severity within 5 business days. • Updates: We will keep you informed of our progress toward resolution. • Resolution: We aim to resolve critical vulnerabilities within 30 days and other issues within 90 days. • Credit: With your permission, we will publicly acknowledge your contribution once the issue is resolved.

When researching vulnerabilities, please: • Do not access, modify, or delete data belonging to other users • Do not degrade the availability or performance of the Service • Do not use automated scanners or tools that generate excessive traffic • Do not publicly disclose the vulnerability before we have had a reasonable opportunity to fix it • Do not exploit the vulnerability beyond the minimum necessary to demonstrate it • Do not perform social engineering or phishing attacks against Phirise employees or users

If you conduct security research in compliance with this policy, we consider it authorized and will not pursue legal action against you. We ask that you report vulnerabilities to us before disclosing them publicly so we can protect our users. This safe harbor does not apply to vulnerabilities found in third-party systems, even if those systems are integrated with Phirise. Please report those to the respective third party.

The following are generally not eligible for this policy: • Denial of service (DoS/DDoS) attacks • Social engineering or phishing of Phirise employees or users • Physical attacks against Phirise offices or data centers • Issues in third-party software or services not under Phirise's control • Reports from automated vulnerability scanners without a demonstrated exploit • Missing security headers that do not lead to a demonstrable vulnerability • Rate limiting or brute-force issues on non-sensitive endpoints

Security Team Phirise, Inc. 2261 Market Street STE 86584 San Francisco, California 94114 Email: security@phirise.com PGP: Available upon request