Vulnerability Disclosure Policy

1. Purpose

Success Layer welcomes good-faith reports of suspected security vulnerabilities in the systems listed below. This policy explains what is in scope, the rules that apply to testing, how to report, and what you can expect from us.

If you follow this policy, we will treat your research as authorized under it. Please read Section 10 for the limits of that authorization.

2. Systems in Scope

• https://getsuccesslayer.com — the public Success Layer marketing website.
• https://app.getsuccesslayer.com — the Partner Success Pulse production application.

3. Out of Scope

The following are out of scope unless Success Layer gives prior written authorization:

• any other subdomain of getsuccesslayer.com;
• preview deployments and temporary deployment URLs;
• infrastructure-provider domains and consoles;
• customer-controlled systems, networks, devices, or environments that Success Layer does not operate;
• another customer's accounts or data;
• any account or data you are not expressly authorized to use.

Third-party providers are out of scope. Success Layer uses third-party providers to operate its systems. Nothing in this policy authorizes you to test, probe, or attack a provider's systems — including Vercel, Neon, Resend, Sentry, Cal.com, Microsoft, or Namecheap — merely because Success Layer uses them. Those providers have their own policies, and only they can authorize testing of their systems.

4. Rules of Engagement

Use only accounts and data you own or are expressly authorized to use. The App is invite-only. Use only accounts for which Success Layer or an applicable customer has expressly authorized testing; ordinary access to an account does not by itself grant permission to test with it. Do not create, obtain, or access additional accounts through unauthorized means.

Use the minimum activity necessary to demonstrate an issue, stop as soon as you have demonstrated it, and report it to us.

5. Multi-Tenant Isolation Testing

Partner Success Pulse is a multi-tenant SaaS product. If you suspect an authorization or tenant-isolation issue, do not use the suspected issue to browse, enumerate, copy, or retrieve another customer's information. Demonstrate the issue using your own accounts, harmless identifiers, or the smallest non-sensitive proof possible, then stop and report it.

If you unexpectedly access another tenant's data or other information you are not authorized to see, stop immediately, do not retain or share it, and tell us what happened.

6. PHI and Patient Information

Partner Success Pulse is not intended to hold protected health information or patient information. Do not intentionally seek, access, transmit, copy, include, or retain PHI or patient information during testing or in a report.

If such information appears unexpectedly, stop, do not retain or share it, and report only the minimum security details we need to understand and fix the issue.

7. Prohibited Testing

The following are not authorized under this policy:

• brute-force attacks, password spraying, and credential stuffing;
• high-volume sign-in attempts or high-volume password-reset attempts;
• testing intended to defeat, exhaust, or evade account lockout or rate limiting;
• denial-of-service or distributed denial-of-service testing, flooding, and resource exhaustion;
• automated scanning or fuzzing that creates material load or excessive request volume;
• social engineering, phishing, or pretexting directed at anyone;
• physical intrusion or attempts to access facilities;
• malware, persistence mechanisms, or lateral movement;
• disabling, bypassing, or degrading security controls beyond what is needed to demonstrate a specific issue;
• destructive modification or deletion of data;
• exfiltration of data;
• testing of any third-party system, as described in Section 3.

8. How to Report

Send reports to security@getsuccesslayer.com. Anonymous reports are accepted — we do not require your real name, a phone number, or government identification.

A useful report generally includes:

• a description of the issue and why you believe it is a security problem;
• the affected URL or host;
• steps to reproduce;
• a minimal proof of concept;
• the date and time of testing;
• the testing IP address, if you choose to share it;
• how we can reach you, if you would like a reply;
• any planned disclosure timing.

Please do not include unnecessary Customer Data, PHI, patient information, credentials, tokens, or secrets in a report. Describe what you found rather than sending the underlying data.

We ask that you give us a reasonable opportunity to investigate and remediate before disclosing an issue publicly, and that you coordinate timing with us.

9. What Success Layer Will Do

We will acknowledge and review your report as reasonably practicable, triage it, ask you for more detail where we need it, validate the issue, and remediate as appropriate. We will try to keep you reasonably updated where that is practical.

We do not commit to a fixed acknowledgment or remediation timeframe.

Success Layer will treat the report and reporter information as confidential to the extent reasonably possible, subject to legal obligations and the need to investigate, remediate, or coordinate with relevant service providers.

10. Safe Harbor

Research conducted strictly within this policy's scope and conditions is authorized by Success Layer to the extent it can grant that authorization. Success Layer will not initiate or knowingly support legal action solely for that authorized research. We also will not initiate or knowingly support legal action solely for accidental, good-faith violations of this policy that do not cause harm, are promptly reported, and stop when discovered. This limited nonpursuit commitment does not expand the permitted testing scope.

This policy does not authorize:

• intentional harm to Success Layer, its customers, or any other person;
• extortion, or any demand for payment in exchange for withholding a report;
• unlawful conduct;
• testing of third-party systems;
• violations of another party's rights;
• intentional activity outside this policy. The limited nonpursuit commitment for accidental violations is described above.

Success Layer cannot authorize activity on behalf of another provider or person. If your research would affect a third party's systems, you need that party's authorization, not ours.

11. Rewards

Success Layer does not currently operate a public paid bug-bounty program. No payment, swag, hall of fame, or public recognition is promised. Any recognition or reward is entirely discretionary unless separately agreed in writing.

12. Common Low-Value Reports

The following are generally not treated as actionable standing alone unless a meaningful security impact or exploit chain is demonstrated:

• cosmetic or user-interface issues;
• publicly accessible files containing no sensitive information;
• missing security headers without demonstrated impact;
• clickjacking without meaningful exploit impact;
• generic banner or version disclosure;
• cookie flag observations;
• username or account enumeration;
• rate-limit observations;
• automated scanner output that has not been manually validated.

None of these is inherently incapable of being a vulnerability. If you can show real impact, tell us and we will look at it.

13. Privacy and Handling of Report Information

Security reports may contain contact information, IP addresses, technical identifiers, browser and device details, timestamps, and other information needed to investigate the issue. Success Layer handles that information according to its Privacy Policy and uses it for security investigation, remediation, and related communications.

Do not include unnecessary Customer Data, PHI, patient information, credentials, secrets, or personal information in a report.

14. Relationship to Other Documents

Our Security page describes how Partner Success Pulse handles account-level operational information, tenant isolation, role boundaries, and what we do not claim.

Customer-facing security and incident obligations are set by the applicable signed customer agreement, Order Form, and Data Processing Addendum. This policy does not create, replace, or vary those obligations, or override customer-specific restrictions in a signed agreement.

This policy does not expand Success Layer's rights to use Customer Data.

Research conducted strictly within the scope and conditions of this policy is authorized under it. Success Layer's general website and Service testing restrictions do not prohibit that authorized research.

For purposes of any Success Layer term requiring prior written authorization and an agreed testing scope for security testing, this published Vulnerability Disclosure Policy constitutes Success Layer's written authorization and defines the permitted testing scope only for research conducted strictly in accordance with this policy. This policy does not authorize testing outside the systems, methods, or conditions expressly permitted here.

15. Contact

Sasa Ilic d/b/a Success Layer
Nassau County, New York, USA
Security: security@getsuccesslayer.com
Legal: legal@getsuccesslayer.com
Privacy: privacy@getsuccesslayer.com