Vulnerability Disclosure Program

1. How to Report a Vulnerability

Email security@pluk.ai with the details of your finding. Please do not report security issues through support channels, social media, or public issue trackers.

To help us triage quickly, please include:

• A description of the vulnerability and the impact you believe it has
• The affected URL, endpoint, or component, and the environment you tested against
• Clear steps to reproduce, including any request or response samples, scripts, or screenshots
• Any accounts, identifiers, or test data you used, so we can trace your activity in our logs
• How you would like to be credited, if you would like public credit once the issue is resolved

Reports may be submitted in English. If you wish to encrypt your report, contact us at the address above and we will arrange a secure channel.

2. Scope

In scope

• pluk.ai and its subdomains, including our marketing site and web application
• api.pluk.ai, our application programming interface
• The Pluk Slack application, including its OAuth installation flow, event handling, and any data it stores
• Authentication, authorization, and tenant isolation across any of the above

Out of scope

• Services operated by third parties, including Slack, Clerk, Stripe, Google Cloud, and LinkedIn. Report those to the relevant provider.
• Denial of service, volumetric testing, resource exhaustion, and anything that degrades service for other users
• Social engineering, phishing, or physical attacks against Pluk staff, customers, or facilities
• Reports generated solely by automated scanners without a demonstrated, exploitable impact
• Missing security headers, cookie flags, TLS configuration preferences, and similar findings with no demonstrated exploit path
• Email configuration issues such as SPF, DKIM, and DMARC records, absent a working spoofing demonstration
• Vulnerabilities affecting only unsupported or end of life browsers and platforms
• Self inflicted issues that require a compromised device or account

3. What You Can Expect From Us

• We will acknowledge receipt of your report within three business days.
• We will provide an initial assessment, including whether we have reproduced the issue, within ten business days.
• We will keep you updated on our progress as we work toward a fix, and we will let you know when the issue is resolved.
• We will not take legal action against you, or ask law enforcement to do so, provided you follow the guidelines on this page.
• With your permission, we are glad to publicly credit you once the issue has been remediated.

4. Guidelines for Researchers

We ask that you:

• Give us a reasonable opportunity to resolve the issue before disclosing it publicly or to any third party.
• Make a good faith effort to avoid privacy violations, data destruction, and interruption or degradation of our services.
• Only interact with accounts you own or have explicit permission to test. Do not access, modify, download, or retain data belonging to other customers.
• Stop testing and report immediately if you encounter any customer data, including Slack message content, candidate records, or personal information.
• Delete any customer data you obtained in the course of your research once you have reported it.
• Do not use the vulnerability to pivot further into our infrastructure than is necessary to demonstrate impact.

5. Safe Harbor

If you make a good faith effort to comply with this policy during your research, we will consider your research to be authorized, we will work with you to understand and resolve the issue quickly, and Pluk will not pursue or support legal action against you in connection with that research.

If a third party initiates legal action against you in connection with research you conducted under this policy, and you have complied with it, we will make it known that your actions were authorized.

This safe harbor does not extend to activity that violates the guidelines above, that intentionally accesses or exfiltrates customer data, or that is otherwise unlawful. If you are unsure whether a specific action is authorized, contact us at security@pluk.ai before proceeding and we will clarify.

6. Rewards

Pluk does not currently operate a paid bug bounty program, and we do not offer monetary rewards for reports submitted under this policy. We do take every report seriously, we respond to all of them, and we are happy to provide public credit and a written acknowledgement of your contribution.

7. Contact