Trust · Vulnerability Disclosure Policy

Vulnerability Disclosure Policy

Last updated: September 30, 2026

The safety and security of our customers' data are of utmost importance to Richpanel. We aim to design and build products and services with the highest levels of security and reliability. Despite our best efforts, vulnerabilities may still be present. We welcome the responsible and ethical disclosure of potential security vulnerabilities from security researchers, customers, and the general public. This policy sets out what we expect when you report a vulnerability, and how we handle it.

1. Scope

This policy applies to any digital assets owned, operated, or maintained by Richpanel, including the Richpanel application, APIs, messenger widget, and subdomains of richpanel.com and richpanel.dev.

It excludes third-party services that can be reached through one of our subdomains or that are integrated with one of our products. Please report issues in those services to the vendor that owns them.

We do not accept reports for vulnerabilities that only affect our marketing website (www.richpanel.com), which holds no customer data. Reports that describe theoretical attack vectors without substantiated proof of exploitability are also out of scope.

2. Our commitments

When you disclose an issue to us in line with this policy, Richpanel will:

• Acknowledge your report within 5 business days, and work with you to understand and address it
• Triage and classify the reported vulnerability using the Common Vulnerability Scoring System (CVSS v3.1) within 5 business days of acknowledgment
• Remediate confirmed vulnerabilities within the following timelines, starting from the date the vulnerability is confirmed:
  • Critical (CVSS 9.0 to 10.0): within 15 calendar days
  • High (CVSS 7.0 to 8.9): within 30 calendar days
  • Medium (CVSS 4.0 to 6.9): within 90 calendar days
  • Low (CVSS 0.1 to 3.9): within 180 calendar days
• Keep you informed of our progress in fixing confirmed issues
• Keep information about you and the vulnerability you disclose confidential, unless we agree otherwise

3. Guidelines

When you disclose an issue to us in line with this policy, you agree to:

• Act in good faith and not misuse our systems and applications in ways that harm Richpanel or our customers
• Notify us as soon as you discover a real or potential security issue
• Disclose the issue to third parties or the public only after we deploy a fix, and only with Richpanel's express prior written authorization. That authorization will set the timing of the disclosure and the level of detail to include.
• Make your report without any expectation or requirement of a reward or other benefit, financial or otherwise, and without any expectation or requirement that Richpanel corrects the reported issue

You also agree to:

• Not access, modify, or delete data that belongs to accounts or workspaces you did not create yourself
• Not use an exploit to compromise or exfiltrate data, establish persistent command-line access, or pivot to other systems. Use an exploit only to the extent needed to confirm a vulnerability is present. If in doubt, report the issue to us for confirmation.
• Not submit a high volume of low-quality reports, such as unverified output from automated scanners
• Not use any of the following test methods:
  • Denial of service (DoS or DDoS) tests, or any other test that impairs access to or damages a system or data
  • Physical testing, such as office access, open doors, or tailgating
  • Social engineering, such as phishing or vishing, or any other non-technical vulnerability testing

4. Authorization

If you make a good-faith effort to comply with this policy during your security research, we will consider your research authorized, we will work with you to understand and resolve the issue quickly, and Richpanel will not initiate legal action related to your research or findings. If a third party initiates legal action against you for activities conducted in line with this policy, we will make this authorization known.

5. Reporting an issue

What to include in your report

At a minimum, your report should include:

• The affected endpoints or URLs
• A description of the issue
• A description of the security impact
• Specific, detailed steps to reproduce the issue
• Screenshots, videos, HAR files, and code snippets where possible

If you're a customer

Contact our support team at support@richpanel.com.

If you're a security researcher

Email your report to dpo@richpanel.com.