🔐 MeltPlan Security Disclosure Policy

1. Reporting a Vulnerability

If you believe you have identified a security vulnerability affecting MeltPlan systems, please report it to: security@meltplan.com

Please include:

• A clear description of the issue
• Steps to reproduce
• Impact assessment (if known)
• Screenshots or logs (if applicable)
• Your contact information

We will acknowledge receipt within 5 business days.

2. Responsible Disclosure Guidelines

We ask that researchers:

• Do not access, modify, or delete customer data.
• Do not disrupt services (e.g., DoS, spam campaigns).
• Do not perform social engineering.
• Do not exploit the issue beyond what is necessary to demonstrate proof.
• Provide reasonable time for remediation before public disclosure.

Unauthorized or disruptive testing may be considered abuse.

3. Scope

This policy applies to:

• meltplan.com
• Subdomains owned and operated by MeltPlan
• Production systems controlled by MeltPlan

Out of scope:

• Third-party services
• Social engineering
• Physical security testing
• Automated mass scanning without coordination
• Spam or email spoofing demonstrations without prior consent

4. Rewards

MeltPlan does not currently operate a public bug bounty program.

At our discretion, we may offer a goodwill token of appreciation for valid, responsibly disclosed vulnerabilities. Any such gesture:

• Is entirely discretionary
• Does not imply the existence of a formal bounty program
• Does not create entitlement to future compensation

5. Safe Harbor

If you act in good faith and follow this policy:

• We will not initiate legal action
• We will not pursue civil claims related to your research
• We request coordination prior to public disclosure

6. Disclosure Timeline

We aim to:

• Acknowledge report: within 5 business days
• Provide status update: within 14 business days
• Resolve validated issues promptly based on severity