Security & responsible disclosure
We handle sensitive screening data, so we take security seriously — and we welcome the security-research community’s help. If you believe you’ve found a vulnerability in VolunteerBadge, we want to hear from you, and we commit to working with you in good faith.
How to report
Email support@screenforgelabs.com with the subject “Security vulnerability report.” Please include:
- The affected URL, endpoint, or feature.
- Clear, reproducible steps and any proof-of-concept.
- The impact you believe it has, and the browser/tooling you used.
Our machine-readable security contact is published at /.well-known/security.txt (RFC 9116).
Our safe-harbor commitment
If you make a good-faith effort to follow this policy during your research, we will consider your research authorized, we will not pursue or support legal action against you for it, and we will work with you to understand and resolve the issue quickly. Act in good faith, avoid privacy violations and service disruption, and only interact with accounts you own or have explicit permission to test.
Scope
In scope
- volunteerbadge.com and its subdomains (app, support, academy, status).
- Our public API and web application.
- Authentication, authorization, and data-exposure issues.
Out of scope
- Denial-of-service, volumetric, or brute-force testing.
- Social engineering, phishing, or physical attacks.
- Findings solely from automated scanners without a demonstrated impact.
- Vulnerabilities in third-party services we don’t control.
What to expect
We aim to acknowledge your report within two business days, keep you updated as we investigate, and let you know when the issue is resolved. Please give us a reasonable window to fix a confirmed issue before any public disclosure, and don’t access, modify, or retain data beyond the minimum needed to demonstrate the finding. We don’t run a paid bug-bounty program today, but we’re glad to credit researchers who responsibly disclose (with your permission).
This policy was last updated on July 28, 2026. VolunteerBadge is operated by ScreenForge Labs, LLC, an FCRA-regulated consumer reporting agency.