What we cover.
In scope for coordinated disclosure:
https://login.modfolio.io— auth issuerhttps://account.modfolio.io— admin dashboardhttps://connect.modfolio.io— this site- The published
@modfolio/connect-sdknpm package - Any documented OIDC, SAML, SCIM, or DPoP behavior of the issuer
Out of scope:
- Cloudflare's own infrastructure (report directly to Cloudflare)
- Other services that support Connect (each follows its own disclosure process)
- Volumetric / DDoS / brute-force at the edge layer
- Social engineering, physical security
- Findings that require an already-compromised victim (e.g. self-XSS where the attacker controls the victim's input)
- Missing security headers without a demonstrated attack chain
How to report.
Open a private report via GitHub Security Advisories. This is the canonical channel — it gives us a private workspace with the reporter, supports attaching reproducers, and creates an audit trail tied to the source code. No email alias is published; GitHub handles transport security and access control end-to-end.
Include:
- Affected URL or component
- Reproducer steps
- Impact (what an attacker could do)
- Your name + affiliation, if you would like acknowledgment
What to expect.
| Step | Target time |
|---|---|
| Acknowledgment of report | within 2 business daysACK |
| Initial triage decision (in scope / not in scope) | within 5 business daysTRIAGE |
| Mitigation timeline shared with reporter | 14 days (critical) · 30 days (high) · 90 days (medium)PLAN |
| Public disclosure | after mitigation ships, coordinated with reporterPUBLISH |
Safe harbor.
Researchers who report findings in good faith under this policy will not be subject to legal action by Modfolio for accidental disruption caused by their testing, provided they:
- Make a good faith effort to avoid privacy violations and service degradation
- Only access accounts they own or test accounts they have created
- Do not retain, exfiltrate, or modify customer data
- Give us a reasonable mitigation window before public disclosure
Aggressive automated scanning that exceeds 100 req/sec from a single source is considered out of good faith and may be treated as an attack.
Hall of fame.
We publicly acknowledge researchers who report valid findings here. (No public reports yet.)
Out-of-band channels.
If GitHub Security Advisories is unavailable for any reason (account lockout, GitHub outage), open a public issue with the minimum information needed to reach us (do not include exploit details) at the issue tracker. A maintainer will reach out for the encrypted detail via the channel of your choosing.
Bug bounty.
We don't run a monetary bounty program yet. As the service reaches the scale that warrants it, we may offer acknowledgements, swag, or private-program invites. The current disclosure relationship rests on collaborative goodwill, not a paid contract.