Vulnerability Disclosure Policy

How to Report

Email support@buildrok.com with "Security" in the subject line. A useful report includes:

• The affected URL, endpoint, or host.
• Steps to reproduce, in enough detail that we can follow them.
• What an attacker could actually do with it.
• Any proof such as a request, response, screenshot, or short recording.

Please send reports in English. Do not include real customer data in the report itself: describe the exposure rather than pasting what you found.

What Happens Next

• Acknowledgement within 2 business days, confirming we received the report.
• Triage within 10 business days, telling you whether we could reproduce it, how we rate the severity, and roughly when we expect a fix.
• Resolution. We will tell you when the fix ships. If we decide not to fix something, we will say so and explain why rather than going quiet.

Buildrok is a small team, so these are targets we work to rather than a contractual guarantee. If you have not heard back within 2 business days, send a follow-up.

Scope

In scope:

• buildrok.com and www.buildrok.com, including the site editor and the customer dashboard
• Published customer sites on buildrok.com/s/ and on their own custom domains
• The Buildrok API under buildrok.com/api/
• img.buildrok.com, the image delivery host

Out of scope:

• Denial of service, load testing, or anything that degrades service for real customers
• Social engineering, phishing, or physical attacks against Buildrok staff or customers
• Findings that only affect a customer's own content, such as a business publishing its own phone number
• Reports generated solely by an automated scanner with no demonstrated impact
• Missing hardening headers, cookie flags, or TLS configuration with no working exploit
• Vulnerabilities in our infrastructure providers, which should go to that provider directly

Out of scope does not mean unwelcome. If you think a finding on that list has real impact in our specific setup, send it anyway and explain the impact.

Rules for Testing

Our customers are real businesses whose sites carry their real leads. When you test:

• Use your own account and your own test site wherever possible.
• Stop as soon as you have confirmed a vulnerability. Do not pivot further into the system, and do not access, modify, download, or retain data belonging to anyone else.
• If you do come across someone else's data by accident, stop, tell us, and delete your copy.
• Do not run scans or tooling heavy enough to affect availability for other users.
• Give us a reasonable chance to fix the issue before disclosing it publicly. We are happy to coordinate timing with you.

Good-Faith Protections

If you follow this policy, we will treat your research as authorised, we will not pursue or support legal action against you over it, and we will work with you if a third party raises a complaint about activity that stayed within these rules. The prohibition on probing our systems in our Terms of Service does not apply to testing carried out under this policy.

This protection is ours to give and covers Buildrok only. Buildrok runs on third-party infrastructure, and their terms still govern testing that reaches them. If you are unsure whether something is in bounds, ask us first at support@buildrok.com.

Rewards

Buildrok does not run a paid bug bounty program. We will credit you by name on request once a fix has shipped, and we would rather say that plainly up front than have you spend time expecting a payout.

Machine-Readable Version

The same contact details are published as an RFC 9116 file at /.well-known/security.txt.