Vulnerability Disclosure Policy

Last updated: October 14, 2026

Esta política está disponível apenas em inglês, por ser o texto oficial de segurança. Dúvidas em português? Escreva para security@clearworks.ca.

ClearWorks Foundry Inc. welcomes reports from security researchers who find vulnerabilities in our website or services. This policy outlines what is in scope, how to send us a report, and what you can expect in return.

Scope

In scope:

• *.clearworks.ca (including clearworks.ca, www.clearworks.ca, api.clearworks.ca, and mta-sts.clearworks.ca)
• The contact-form API endpoint at https://api.clearworks.ca/contact
• DNS configuration and email authentication records (SPF, DKIM, DMARC, MTA-STS, TLS-RPT)

Out of scope:

• Third-party infrastructure and services we rely on (AWS, SendGrid, hCaptcha, Google Workspace, report-uri.com, CIRA) — please report vulnerabilities directly to the respective vendor.
• Social engineering or phishing targeting ClearWorks personnel.
• Physical security attacks.
• Volumetric or application-layer denial-of-service (DoS/DDoS) testing.
• Missing security headers or scanner warnings that do not lead to a demonstrable vulnerability.
• Automated scan output submitted without a working proof of concept.
• General best-practice suggestions without an exploitable security impact.

How to report

Email your findings to security@clearworks.ca and include:

1. A clear description of the vulnerability and its potential impact.
2. Step-by-step reproduction instructions, including any proof-of-concept code, payloads, or HTTP requests.
3. The affected URL, endpoint, or DNS record.
4. How you would like to be credited (or whether you prefer to remain anonymous).

What to expect from us

• Acknowledgement within 5 business days.
• Triage and severity assessment within 10 business days.
• Progress updates at least every 14 days while remediation is underway.
• Confirmation as soon as the fix is deployed.
• Public credit if you would like to be acknowledged.

Safe harbour

We consider good-faith security research conducted within the bounds of this policy to be authorized access. We will not bring legal action or initiate law-enforcement investigations against researchers who:

• Comply with this policy.
• Only access, modify, or delete data to the minimum extent needed to prove the vulnerability exists (using your own test submissions where possible).
• Avoid disrupting or degrading our services for other visitors.
• Give us a reasonable window to remediate the issue before disclosing it publicly.
• Never engage in extortion, demand payment, or threaten disclosure.

If you inadvertently encounter personal data during your research, stop testing immediately, notify us in your report, and delete any copies you hold.

Coordinated disclosure

Please allow us time to remediate reported vulnerabilities before publishing technical details. Our standard disclosure window is 90 days from acknowledgement, which we can extend by mutual agreement for complex fixes. Once a fix is live, you are welcome to publish right away.

Recognition

As a small foundry, ClearWorks does not currently run a paid bug bounty program. What we do offer is our genuine gratitude, public credit if you want it, and direct communication with the engineer fixing the issue.

Policy updates

We may revise this policy over time; this page is always the authoritative version and is linked directly from our security.txt file.

Contact

Questions about this policy or an active report? Write to security@clearworks.ca.