Email support@filingsift.com with “Security report” in the subject. Include the affected URL, impact, reproducible steps, and a safe proof of concept.
Do not access, change, retain, or disclose another person’s data. Do not degrade availability, perform denial-of-service testing, send spam, use social engineering, or test third-party services. Stop and report immediately if you encounter non-public data.
During pre-commercial evaluation, FilingSift targets an acknowledgment within two business days but does not guarantee a response or remediation time. There is no bug-bounty program or monetary reward. Any testing beyond passive observation requires advance written authorization.