Report a security issue

If you find a vulnerability in JobSprout, please tell us privately so we can fix it before anyone else finds it.

How to report

Email david@jobsprout.ai with "Security report" in the subject. Include the affected URL, the steps to reproduce it and what an attacker could do with it.

We reply within five working days and keep you updated until the issue is fixed. Our security.txt holds the same contact details.

In scope

• jobsprout.ai and its subdomains
• Personal sites on jobsprout.me
• The JobSprout browser extension
• The JobSprout connector for ChatGPT at jobsprout.ai/mcp

Rules

• Test only against accounts you own.
• Stop as soon as you reach someone else's data, and do not keep, change or share it.
• Do not run denial-of-service, spam, social-engineering or physical attacks.
• Give us 90 days to fix the issue before you publish anything about it.

Safe harbour

If you act in good faith and follow the rules above, we will not take legal action against you or report you to the authorities for your research.

Rewards

We have no paid bug bounty. With your permission, we will credit you once the fix is live.