REQeV Responsible Disclosure Policy

This Responsible Disclosure Policy (“Policy”) is published by ECDG, Inc., a California corporation, doing business as REQeV (“REQeV”, “we”, “us”). It explains how to report security vulnerabilities in the REQeV Services, what we ask of researchers, and what researchers can expect from us in return.

Recruiting firms and employers trust REQeV with sensitive candidate and contact information. We welcome reports from the security community and will work with you in good faith to understand and fix real issues.

1. Our Commitment

We are committed to protecting the confidentiality, integrity and availability of the REQeV Services and the data our customers entrust to us. Independent research is an important part of that effort.

If you discover a vulnerability and report it to us in line with this Policy, we will acknowledge your report, investigate it promptly, keep you informed of our progress, and treat your research as authorized as described in Section 7 (Safe Harbor).

This Policy does not create a paid bug bounty program, and it does not give anyone permission to access, use or disclose data that belongs to REQeV customers or their candidates beyond what is strictly necessary to demonstrate a vulnerability.

2. Scope

This Policy covers the following systems operated by REQeV:

• reqev.com, including our marketing website and billing hub
• app.reqev.com, including the REQeV ATS, REQeV Sourcing and REQeV Mission Control applications
• Other subdomains of reqev.com that are operated by REQeV
• REQeV application programming interfaces (APIs) and integration endpoints operated by REQeV
• REQeV browser extensions published by REQeV in official browser extension stores

If you are unsure whether a system is in scope, email support@reqev.com before testing and we will let you know.

3. Out of Scope

The following are not in scope for this Policy. Reports on these topics will generally be closed without action, unless you can show a concrete and meaningful security impact on REQeV or its customers.

• Third-party services that REQeV uses, such as Vercel, Supabase and Stripe, and their own infrastructure; please report issues in those services directly to the provider under its own disclosure program
• Denial of service attacks, volumetric testing, load testing or any testing that degrades the availability of the Services
• Social engineering, phishing, pretexting or other attempts to deceive REQeV personnel, customers, candidates or vendors
• Physical attacks on REQeV offices, equipment or personnel, or on the facilities of our service providers
• Spam, email flooding, or missing or weak rate limiting that does not lead to a demonstrated security impact
• Missing HTTP security headers or cookie flags without a demonstrated, exploitable impact
• Reports about SPF, DKIM or DMARC configuration
• Clickjacking on pages that do not allow any sensitive or state-changing action
• Self-XSS, or any issue that requires a user to paste code into their own browser or console
• Issues that affect only outdated, unsupported or unpatched browsers, operating systems or plugins
• Output from automated scanners or tools that has not been manually validated and shown to be exploitable
• Vulnerabilities in customer-controlled content, configurations or third-party integrations that REQeV does not operate

4. Rules of Engagement

To be covered by this Policy, you must follow these rules while researching and reporting:

1. Use only accounts you create yourself for testing, and interact only with data you own or that REQeV has created for your testing.
2. If you access, or could access, data belonging to another person or organization, stop testing immediately, do not view further, and report the issue to us right away.
3. Do not download, copy, retain, share or exfiltrate any data beyond the minimum needed to demonstrate the vulnerability, and securely delete anything you obtained once you have reported it.
4. Do not perform destructive testing, including modifying or deleting data, disrupting the Services, or planting persistent code, backdoors or malware.
5. Do not use a vulnerability for any purpose other than confirming it, and do not pivot to other systems once you have confirmed an issue.
6. Keep the details of the vulnerability confidential and do not disclose them publicly or to third parties until we have fixed the issue or 90 days have passed since your report, whichever comes first, unless we agree otherwise in writing.
7. Comply with all applicable laws and with our Terms of Service and Acceptable Use Policy, except to the extent this Policy expressly authorizes your research.
8. Do not demand payment or other compensation as a condition of sharing or withholding vulnerability details.

If a fix will take longer than 90 days, we will explain why and ask to agree a reasonable extension with you. We ask that you give us a fair opportunity to protect customers before any public disclosure.

5. How to Report a Vulnerability

Send your report by email to support@reqev.com. Please write in English and send one vulnerability per report where possible.

What to include

• A clear description of the vulnerability and the system, URL, API endpoint or extension version affected
• The type of issue (for example, broken access control, injection or cross-site scripting)
• Step-by-step instructions to reproduce the issue, including any proof-of-concept code, requests or screenshots
• The potential impact, including what an attacker could access or do
• The date and time of your testing and the test accounts you used
• Any suggested fix or mitigation, if you have one
• How you would like to be credited, if at all, and how we can contact you

Encrypting your report

If your report contains sensitive details, send an initial email without those details and we will arrange a secure channel, such as an encrypted upload or a PGP key, before you share them.

security.txt

Our contact details for security reports are also published in machine-readable form at https://www.reqev.com/.well-known/security.txt in line with the security.txt standard.

6. Our Commitments

When you report a vulnerability in line with this Policy, we will aim to meet the following timelines. Business days are Monday through Friday, excluding U.S. federal holidays.

We assign severity based on the actual risk to REQeV and its customers, considering factors such as exploitability, the data or functions exposed, and any mitigating controls. We may use an industry framework such as the Common Vulnerability Scoring System (CVSS) as a guide.

These timelines are targets, not guarantees. Complex issues, issues that depend on third-party providers, or issues requiring customer action may take longer, and we will keep you informed if that happens.

We will also:

• Treat your report and your personal information confidentially and use it only to investigate and address the issue
• Not share your identity with third parties without your permission, unless required by law
• Let you know when the issue has been resolved, and, where appropriate, give you an opportunity to confirm the fix
• Notify affected customers where required by law or our contracts, including our Data Processing Addendum

7. Safe Harbor

REQeV considers security research conducted in good faith and in line with this Policy to be authorized. For research that meets these conditions:

• We will not initiate or support legal action against you, and we will not report you to law enforcement, in connection with that research.
• We will not pursue claims against you under the Computer Fraud and Abuse Act (18 U.S.C. § 1030), California Penal Code Section 502, or similar state computer crime laws, for accessing our systems as part of that research.
• We will not pursue claims against you under the anti-circumvention provisions of the Digital Millennium Copyright Act (17 U.S.C. § 1201) for circumventing technological measures to the extent necessary for that research.
• We waive restrictions in our Terms of Service and Acceptable Use Policy that would otherwise prohibit that research, solely to the extent needed for research within this Policy.

If a third party brings legal action against you for research that complied with this Policy, we will make it known that your activities were conducted in line with this Policy and authorized by REQeV.

This safe harbor applies only to REQeV systems in scope under Section 2. We cannot authorize research on systems operated by others, including our service providers, and we cannot bind any third party, law enforcement agency or regulator.

Safe harbor does not apply if you violate this Policy, act in bad faith, access or disclose customer or candidate data beyond what is strictly necessary, or attempt extortion. If you are unsure whether a planned activity is consistent with this Policy, contact support@reqev.com before proceeding.

8. Recognition

REQeV does not offer a monetary bug bounty or other payment for vulnerability reports at this time. Any reward we choose to offer is at our sole discretion and does not create an obligation to offer future rewards.

With your permission, we may publicly thank you by name or handle in a security acknowledgments list (hall of fame) for valid, previously unknown issues that result in a fix. We will not publish your name without your consent.

9. Changes to This Policy

We may update this Policy from time to time. The updated version will be posted on this page with a new effective date. Research is governed by the version of this Policy in effect when the research is conducted.

This Policy is not a contract and does not create any rights for third parties, except the safe harbor commitments in Section 7 for researchers who comply with it. Related information is available in our Security and Privacy overview and our Privacy Policy.

10. Contact

Please send vulnerability reports and questions about this Policy to:

• ECDG, Inc., a California corporation, doing business as REQeV
• 236 West Portal Ave #390, San Francisco, CA 94127
• Security reports: support@reqev.com
• Legal notices: support@reqev.com