Responsible Disclosure Policy

Vulnerability Disclosure

At Raptor Technologies, we take security seriously. Security researchers play a vital role in keeping our platform and users safe. If you’ve found a vulnerability in our systems, we want to hear from you, and we’re committed to working with you to resolve it quickly and responsibly. This policy outlines how to report vulnerabilities responsibly, what’s in scope, and how we’ll respond.

What We Ask of You

  • Missing security headers or HTTPS best practices
  • Clickjacking on pages with no sensitive actions
  • Self-XSS or attacks that require physical device access
  • Email security issues (SPF, DKIM, DMARC) without evidence of exploitability
  • Password complexity, account lockout, or brute-force rate-limit policies
  • Outdated software versions without a working exploit
  • Automated scan output without proof of exploitability
  • Third-party services or infrastructure we don’t own or control
  • Vulnerabilities affecting only unsupported or end-of-life browsers
  • Any non-exploitable vulnerabilities or issues related to a lack of best practice

Out-of-Scope

Security issues related to Raptor resources that should not be reported include:
  • Missing security headers or HTTPS best practices
  • Clickjacking on pages with no sensitive actions
  • Self-XSS or attacks that require physical device access
  • Email security issues (SPF, DKIM, DMARC) without evidence of exploitability
  • Password complexity, account lockout, or brute-force rate-limit policies
  • Outdated software versions without a working exploit
  • Automated scan output without proof of exploitability
  • Third-party services or infrastructure we don’t own or control
  • Vulnerabilities affecting only unsupported or end-of-life browsers
  • Any non-exploitable vulnerabilities or issues related to a lack of best practice

The above is in addition to the standard exclusions designated by Bugcrowd.

Submitting a Report

All vulnerability disclosures are managed through our Vulnerability Disclosure Program (VDP) on Bugcrowd. Submissions made outside of Bugcrowd may not receive a response.


By participating, you agree to act in good faith and adhere to the terms set forth by Bugcrowd in addition to the guidelines listed in Raptor’s Responsible Disclosure Policy. In return, we commit to acknowledging your report promptly, keeping you updated throughout our investigation, and not pursuing legal action for good-faith research conducted in accordance with this policy.

Submit a Report

What to Include

  • A clear description of the vulnerability and its potential impact
  • Step-by-step reproduction instructions
  • Screenshots, screen recordings, or a proof-of-concept where applicable
  • The affected URL, endpoint, or component