Vulnerability Disclosure Policy

Last updated: September 2026

EveryCheck takes the security of its platforms and the personal data entrusted to us seriously. We welcome reports from security researchers who help us identify vulnerabilities, and we are committed to working with them in good faith to resolve issues quickly.

This policy explains what is in scope, how to report a vulnerability, the rules for testing, and what you can expect from us.

---

Scope

In scope

Out of scope

• Any subdomain or asset not explicitly listed above
• Third-party services and providers used by EveryCheck (e.g. cloud hosting, email, analytics, payment providers). Please report these issues directly to the vendor.
• Our offices, employees, clients and partners (physical access, social engineering, phishing)

Non-qualifying findings

The following are generally not accepted unless you can demonstrate a concrete security impact:

• Missing HTTP security headers or cookie flags without a working exploit
• Self-XSS or issues requiring an unlikely user interaction
• Clickjacking on pages with no sensitive action
• Software version disclosure or banner grabbing
• Rate limiting issues on non-sensitive endpoints
• Denial of service or volumetric attacks
• Results from automated scanners without manual validation
• Vulnerabilities only affecting outdated or unsupported browsers

---

How to report a vulnerability

Send your report to security@everycheck.com.

Reports can be written in English or French. Please submit one vulnerability per report, unless several issues are chained together to demonstrate impact.

Every report must include:

• A clear description of the vulnerability and the affected URL, endpoint or parameter
• A working, reproducible Proof of Concept with step-by-step instructions and the requests or payloads used
• Screenshots or a short video demonstrating the issue
• A description of the potential impact
• Brief remediation guidelines

Incomplete reports or reports that cannot be reproduced may be closed without further action. Duplicates are credited to the first valid report received.

---

Testing rules

Our platforms process sensitive personal data of candidates and clients. To be covered by this policy, your testing must be strictly non-destructive and respect the following rules:

• Personal data: never access, modify, download or delete data that does not belong to you. If you accidentally access personal data, stop immediately, do not keep any copy, and mention it in your report.
• Traffic: no denial of service, load testing, brute force, or automated scanning generating heavy traffic. Keep your request rate reasonable.
• Security controls: do not attempt to disable or bypass our WAF or monitoring beyond what is strictly necessary to demonstrate the issue.
• Persistence: do not install backdoors, web shells or any persistent access, and do not pivot to other systems.
• Availability: avoid any test that could affect service availability, especially during French business hours (9:00–18:00 CET/CEST).
• Confidentiality: do not share details of the vulnerability with anyone other than EveryCheck until it has been fixed and disclosure has been agreed.

---

What you can expect from us

We will keep you informed throughout the process and let you know when the vulnerability has been fixed.

---

Disclosure

We follow a coordinated disclosure approach. Please give us reasonable time to fix the vulnerability before making any information public. We aim to resolve valid reports within 90 days. If more time is needed, we will explain why and agree on a new timeline with you.

Public disclosure must not include any personal data, credentials or information that could put our users at risk.

---

Recognition

We do not currently offer a fixed monetary bounty. For valid reports, we may offer:

• Public acknowledgment in our Hall of Fame, with your consent
• A thank-you letter or recommendation
• EveryCheck swag for significant findings

Rewards are decided case by case after the vulnerability has been validated and fixed.

---

Data protection

EveryCheck complies with the General Data Protection Regulation (GDPR). Any personal data you encounter during your research must be treated as strictly confidential, must not be retained, copied or shared, and must be deleted once your report is submitted.

Personal data contained in your report (such as your name and email address) will only be used to process your report and to credit you if you wish.

---

Contact

• Email: security@everycheck.com
• security.txt: available at /.well-known/security.txt on each in-scope domain

Thank you for helping keep EveryCheck and our users safe.