Vulnerability Disclosure & Bug Bounty

Keeping our customers' data safe is central to LossFolio. We welcome reports from security researchers and pay rewards for valid, previously unknown vulnerabilities reported under this policy. This policy explains what you may test, how to test it safely, how to report what you find, and what you can expect from us. It is based on the open-source disclose.io framework and the U.S. Cybersecurity and Infrastructure Security Agency's (CISA) vulnerability disclosure policy template.

When you conduct vulnerability research according to this policy, we consider that research to be:

• authorized under the Computer Fraud and Abuse Act (CFAA) and similar state laws, and we will not initiate or support legal action against you for accidental, good-faith violations of this policy;
• exempt from the anti-circumvention provisions of the Digital Millennium Copyright Act (DMCA), and we will not bring a claim against you for circumventing technology controls;
• exempt from restrictions in our Terms of Service and Acceptable Use Policy that would interfere with conducting security research, and we waive those restrictions on a limited basis; and
• lawful, helpful to the overall security of the Internet, and conducted in good faith.

You are expected, as always, to comply with all applicable laws. If a third party brings legal action against you and you have complied with this policy, we will take steps to make it known that your actions were conducted in compliance with this policy. If at any time you have concerns or are uncertain whether your research is consistent with this policy, contact us at security@rosetechhq.com before going any further.

In scope

• lossfolio.com and www.lossfolio.com — the public site, sign-up and sign-in.
• The LossFolio web application and its APIs (/api/…), including accounts and roles, organizations and pricing, report ordering and payment, report downloads and file uploads, the customer profile, the fulfillment board, two-step login, staff support access, the AI assistant, and the audit and access logs.

Out of scope

• Third-party services we use — including Supabase, Vercel, Stripe, Google, Resend, Anthropic, RoofingAssist and PLRB. Report issues in those services to the provider. (A misconfiguration of a third-party service by us that exposes our data is in scope.)
• Other Rose Tech HQ products and domains not listed above.
• Our offices, staff and email accounts: no physical testing, social engineering or phishing.

Test accounts

Test only against accounts you create yourself. Sign up with an email address that includes +bugbounty (for example you+bugbounty@example.com) so we can recognize research accounts. Do not place paid orders with a real card you do not own; if you need to test ordering or a second company, email us and we'll set up research accounts with test credit.

• Only access, change or delete data in accounts you own or have our written permission to test. Use the minimum access needed to demonstrate a vulnerability.
• If you encounter anyone else's data — customer records, homeowner details, photos, reports or credentials — stop, don't save, copy or share it, and report it to us right away.
• Don't use credentials, tokens or keys you find to access anything. Report them instead.
• No denial-of-service or load testing. Keep automated tools to 5 requests per second or less, and don't run high-volume scanners.
• Don't send messages through LossFolio to people who haven't agreed (for example by inviting real email addresses or emailing reports).
• Don't pivot from one vulnerability to explore further systems, or keep access longer than needed.
• Delete any data you obtained once you've reported it, and keep the details confidential until we've fixed the issue (see section 11).

• Seeing or changing another company's data (cross-tenant access, IDOR, broken row-level security)
• Authentication or session flaws, account takeover, privilege escalation (for example a user acting as a company admin, or anyone acting as a Super Admin)
• Bypassing two-step login, getting around staff support-access controls, or changing or deleting audit log entries
• Reading files or reports from another company's storage, or path traversal in uploads and downloads
• Getting reports or add-ons without paying, or changing prices, credits or refunds you shouldn't control
• Injection (SQL, command, template), remote code execution, server-side request forgery (SSRF)
• Stored or reflected cross-site scripting (XSS) that runs for other users; cross-site request forgery (CSRF) on a meaningful action
• Prompt injection that makes the AI assistant reveal another company's data or take an action the user didn't confirm

These are out of scope or don't qualify for a reward, unless you show a real, practical security impact on our users:

• Missing best-practice HTTP headers, cookie flags, or TLS/SSL settings without a working exploit
• SPF, DKIM or DMARC records; email spoofing
• Clickjacking on pages with no sensitive action; logout or sign-in CSRF
• Self-XSS, or XSS that only affects your own account
• Rate limiting on non-sensitive actions; account or email enumeration; password complexity rules
• Content spoofing or text injection without HTML/JavaScript execution
• Version or banner disclosure, verbose errors, stack traces without sensitive data
• Reports from automated scanners without a demonstrated exploit
• Vulnerabilities in outdated browsers or that require physical access to a user's device
• Issues in third-party services (report them to the provider), or that we already know about
• Denial-of-service, social engineering and physical attacks

We pay cash rewards for valid, in-scope vulnerabilities, based on their real impact on LossFolio and its users:

• We set severity using CVSS and our assessment of real-world impact and likelihood. We'll explain if we rate a report lower than you did, and you're welcome to ask us to reconsider.
• The amount within a range depends on impact and on the quality of the report — clear reproduction steps and a working proof of concept earn more.
• Only the first report of an issue is rewarded. Several reports with the same root cause count as one. Issues we already know about, or that are found by our own testing, are not rewarded.
• Valid findings that don't qualify for a cash reward may still be acknowledged on our thanks list.
• Rewards are paid at our discretion and depend on following this policy. Breaking the rules — including accessing other customers' data beyond what's needed, or disclosing before we've fixed the issue — forfeits the reward.

• You must be at least 18, or have a parent or guardian's permission.
• Current and former Rose Tech HQ employees and contractors (within the past 12 months), and their immediate families, are not eligible for rewards.
• You must not be on a U.S. sanctions list or in a country under comprehensive U.S. sanctions.
• You're responsible for any taxes on rewards. We'll ask for a W-9 (U.S.) or W-8BEN (non-U.S.) before paying, and may issue a 1099.
• Rewards are paid in U.S. dollars by PayPal or bank transfer, usually within 30 days after we confirm the fix.

Email security@rosetechhq.com with a subject starting “[Bug Bounty]”. Please include:

• The affected URL, page or API endpoint
• The type of vulnerability and its impact — what an attacker could do
• Step-by-step instructions to reproduce it, with a proof of concept (screenshots, requests or a short video help)
• The email address of the test account(s) you used
• How you'd like to be credited (name or handle), or that you'd prefer to stay anonymous

Please send one vulnerability per report, in plain text (attachments are fine). If you need to send something sensitive in encrypted form, ask and we'll arrange it. Anonymous reports are welcome, though we can't pay a reward without a way to reach you.

We'll keep you informed, may ask you to confirm the fix, and won't share your identity outside our team without your permission.

Please keep the details confidential until the issue is fixed, or for 90 days from your report, whichever comes first — and tell us before you publish so we can coordinate. If we need longer for a complex fix, we'll explain why and agree a date with you. We're happy for you to write about your finding once it's fixed, as long as it doesn't include our customers' data.

We thank the researchers who help keep LossFolio safe. With their permission, people who report valid issues are listed here.

No reports yet — be the first.

We may update this policy. Reports are handled under the version in effect when they were submitted. The effective date is shown at the top of this page.