Vulnerability reporting

At a glance

Purpose: Tell good-faith security researchers (and customer IT teams) how to report vulnerabilities responsibly.

Reporting channel

Email security@amplifyed.app with:

A clear description of the issue.
Steps to reproduce, including any payload or screenshots.
The affected URL or endpoint.
Your contact for follow-up.
(Optional) Your handle for credit.

We acknowledge within one business day and aim to triage within three business days.

Scope

In scope:

*.amplifyed.app and any AmplifyED-hosted subdomain.
The authenticated AmplifyED application and its public intake routes.
Authentication, authorization, and tenant-isolation issues.
Sensitive data exposure.
Server-side and client-side injection.

Out of scope:

Findings on customer-controlled subdomains, content, or DNS.
Volumetric DoS / DDoS.
Social engineering of staff.
Reports from automated scanners without a proof-of-concept exploit.
Best-practice recommendations without a demonstrated vulnerability (e.g. missing headers on non-security-sensitive surfaces).

Safe-harbor expectations

We welcome good-faith research and will not pursue legal action against researchers who:

Avoid privacy violations, destruction of data, and service degradation.
Use only their own test accounts (do not access other tenants' data).
Give us a reasonable window to remediate before disclosing publicly.

Disclosure

We coordinate disclosure with the reporter. Default window is 90 days from triage, shortened if a fix lands earlier and lengthened if the issue is complex. We credit researchers in our security release notes unless asked otherwise.

Bounty

A formal bounty program is on our roadmap. We currently issue acknowledgement and credit; meaningful reports are eligible for swag and case-by-case rewards.

FAQ

Do you have a PGP key? Yes — request it via the security@amplifyed.app inbox and we'll respond with the current key.

How do customers report a vulnerability they discovered? Same channel: security@amplifyed.app. Add "[Customer]" in the subject line and your district name so we can correlate with your tenant.