Vulnerability Disclosure Policy

Last updated: September 14, 2026

This policy governs reports of a security vulnerability or a suspected data breach in the public systems listed in Scope, operated by Ethics Code LLC (“Ethics Code,” “we,” “our,” or “us”).

A data breach involves the loss of, unauthorized access to, or unauthorized disclosure of personal information. A vulnerability is a flaw that could lead to a data breach or to an interruption of the service we provide on those systems.

Send all reports to privacy@ethicscode.ai.

Table of contents

  1. 1. Purpose
  2. 2. Good-faith research
  3. 3. What researchers must, may, and must not do
  4. 4. Scope
  5. 5. Out of scope
  6. 6. Reporting a vulnerability
  7. 7. How we assess reports
  8. 8. Disclosure
  9. 9. Contact

1. Purpose

Confidentiality, integrity, and availability of our information and systems matter to us. We appreciate researchers who help us improve our security. This page is the process to report a vulnerability or a suspected breach so we can contain, assess, and respond quickly and reduce harm.

2. Good-faith research

We encourage you to report any vulnerability or security issue you believe you have found on an in-scope system. We will investigate reports submitted under this policy and work to fix valid issues as soon as we reasonably can.

If you make a good-faith effort to follow this policy, we will treat your research as authorized, we will work with you to understand and resolve the issue, and we will not recommend or pursue legal action related to that research.

This is not a bug-bounty program. We do not promise payment or public credit, though we may thank researchers at our discretion.

3. What researchers must, may, and must not do

Researchers must

  • Stop testing and notify us immediately when you find a vulnerability.
  • Stop testing and notify us immediately if you encounter exposure of nonpublic data.
  • Delete any stored Ethics Code nonpublic data after you have reported the issue.

Researchers may

  • View or store Ethics Code nonpublic data only to the extent needed to document that a potential vulnerability exists.
  • Submit a report anonymously. A contact method helps us ask follow-up questions.

Researchers must not

  • Test any system other than those listed in Scope.
  • Disclose the vulnerability except as described in Reporting and Disclosure below.
  • Engage in physical testing of offices, facilities, or equipment.
  • Engage in social engineering of our staff, candidates, or users.
  • Send unsolicited email, including phishing, to Ethics Code staff or users.
  • Run or attempt denial-of-service or resource-exhaustion attacks.
  • Introduce malware.
  • Test in a way that could degrade, disrupt, or disable our systems, or that of Workable on the careers listing.
  • Delete, alter, share, retain, or destroy our data, or make it inaccessible.
  • Use an exploit to exfiltrate data, obtain command-line access, or establish a persistent presence.

4. Scope

Only the following public URLs are in scope. Subdomains, APIs, or products that are not listed here are out of scope.

The careers URL is hosted by Workable. Report issues that affect that listing page to us at privacy@ethicscode.ai. We may need to involve Workable. Do not attack Workable’s platform beyond that jobs listing.

5. Out of scope

  • Any host, app, or URL not listed in Scope.
  • Client environments, internal tools, and third-party products we do not operate.
  • Findings that require physical access, stolen devices, or compromised accounts you do not own.
  • Volumetric DoS, spam, or issues that depend only on outdated browsers or user misconfiguration.

6. Reporting a vulnerability

Email privacy@ethicscode.ai with a technical description of the issue and steps to reproduce it. Attach tools, screenshots, or other documentation that help us confirm it. Include, if you know:

  1. When you found or exploited the issue (date and time, including time zone).
  2. A description of the vulnerability or breach (including any personal information involved).
  3. How you discovered it, and the cause if known.
  4. Which of the in-scope URLs are affected.
  5. Any project, page, or form involved.

Do not include more personal data than needed to show the issue. Do not attach copies of databases or large exports.

7. How we assess reports

We weigh, among other things:

  1. The type and extent of personal information involved.
  2. Whether more than one person could be affected.
  3. Whether the information is protected (for example by authentication or encryption).
  4. Who now has, or could have, access.
  5. Whether there is a real risk of serious harm to affected people.
  6. Whether the issue could attract media or stakeholder attention.

We will acknowledge receipt when a contact method is provided, and we will follow up if we need more detail. Timing depends on severity and on whether a listed third-party host (Workable) must be involved.

8. Disclosure

Do not publish or share the vulnerability until we have confirmed a fix, or until we agree in writing that disclosure is acceptable. Coordinated disclosure helps protect candidates and visitors. If you reported in good faith and we are slow to respond, write again to privacy@ethicscode.ai before any public post.

9. Contact

Ethics Code LLC
HQ: 110 East Broward Blvd., Suite 1759, Fort Lauderdale, Florida 33301
LATAM Regional: Suite WP 104, Las Américas Highway, Km. 27 ½, La Caleta, Boca Chica, Santo Domingo Este Province, Dominican Republic
Security reports: privacy@ethicscode.ai
Website: https://ethicscode.ai