---
title: Vulnerability reporting
category: security
order: 5
lastUpdated: 2026-06-08
featureAvailability: GA
roles: [admin, district-admin]
relatedArticles: [security/incident-response, procurement/security-overview]
---

## At a glance

- **Purpose:** Tell good-faith security researchers (and customer IT teams) how to report vulnerabilities responsibly.

## Reporting channel

Email **security@amplifyed.app** with:

- A clear description of the issue.
- Steps to reproduce, including any payload or screenshots.
- The affected URL or endpoint.
- Your contact for follow-up.
- (Optional) Your handle for credit.

We acknowledge within **one business day** and aim to triage within **three business days**.

## Scope

In scope:

- `*.amplifyed.app` and any AmplifyED-hosted subdomain.
- The authenticated AmplifyED application and its public intake routes.
- Authentication, authorization, and tenant-isolation issues.
- Sensitive data exposure.
- Server-side and client-side injection.

Out of scope:

- Findings on customer-controlled subdomains, content, or DNS.
- Volumetric DoS / DDoS.
- Social engineering of staff.
- Reports from automated scanners without a proof-of-concept exploit.
- Best-practice recommendations without a demonstrated vulnerability (e.g. missing headers on non-security-sensitive surfaces).

## Safe-harbor expectations

We welcome good-faith research and will not pursue legal action against researchers who:

- Avoid privacy violations, destruction of data, and service degradation.
- Use only their own test accounts (do not access other tenants' data).
- Give us a reasonable window to remediate before disclosing publicly.

## Disclosure

We coordinate disclosure with the reporter. Default window is **90 days** from triage, shortened if a fix lands earlier and lengthened if the issue is complex. We credit researchers in our security release notes unless asked otherwise.

## Bounty

A formal bounty program is on our roadmap. We currently issue acknowledgement and credit; meaningful reports are eligible for swag and case-by-case rewards.

## Related articles

- [Incident response](/help/security/incident-response)
- [Security overview](/help/procurement/security-overview)

## FAQ

**Do you have a PGP key?**
Yes — request it via the security@amplifyed.app inbox and we'll respond with the current key.

**How do customers report a vulnerability they discovered?**
Same channel: security@amplifyed.app. Add "[Customer]" in the subject line and your district name so we can correlate with your tenant.