A clear description of the vulnerability
Step-by-step instructions to reproduce the issue
Any relevant URLs, screenshots, or proof-of-concept code
What an attacker actually gains, and the evidence you observed. Please tell us what you saw when you tested it, rather than what the class of vulnerability can cause in general. Reports that assert an impact without demonstrating it are unlikely to qualify for a reward.
Your assessment of severity (see below)

Please test against accounts you control. Do not use the platform to send email to addresses that are not your own, and do not interact with other customers' data.

We aim to acknowledge reports within 5 business days and will keep you updated as we investigate and remediate.

Scope

In scope

The FounderCatalyst web site (www.foundercatalyst.com)
The FounderCatalyst infrastructure the web site runs on

Out of scope

Denial-of-service (DoS/DDoS) attacks
Social engineering or phishing of FounderCatalyst staff or customers
Physical security attacks
Third-party services, applications, or websites that integrate with FounderCatalyst
Rate limiting or brute-force enumeration unless it leads to a demonstrable security impact
User or email address enumeration, including via registration, login, password reset or account settings
Automated scanning output without a demonstrated vulnerability
Reports of missing security headers without a demonstrated exploit
Software version disclosure without a demonstrated vulnerability
Missing CAA records (CAA asks certificate authorities to restrict issuance; its absence does not by itself allow anyone to obtain a certificate for our domain)
Missing DNSSEC, and other DNS configuration recommendations
Password length limits, and hashing denial-of-service claims (we use bcrypt, which truncates its input, so hashing cost does not grow with password length)
Missing re-authentication on actions the account owner or our support team can reverse
Self-XSS, clickjacking on unauthenticated pages, missing autocomplete attributes, and TLS cipher suite configuration

Severity and rewards

We may reward valid, unique vulnerability reports. Rewards are decided case by case, at our discretion, based on the impact of the finding and the quality of the report.

Severity

Examples

Critical

Remote code execution, authentication bypass, access to other customers' data, SQL injection leading to data exposure

High

Privilege escalation, stored XSS with significant impact, IDOR exposing sensitive records

Medium

Reflected XSS, CSRF on sensitive actions, information disclosure of internal system details

Low

Minor information leakage, non-sensitive CSRF, open redirect without chaining

Final severity classification is determined by FounderCatalyst, taking into account the nature of the vulnerability, the data and systems at risk, and the overall impact to our users. The severity you assign to your own report does not affect the reward.

Rewards are paid per unique vulnerability. Duplicate reports will be credited to the first reporter. Reports that share a single underlying cause are treated as one finding, even where they affect different features or were submitted separately. Where a further report materially changes the scope of the fix, we may award a supplement at our discretion.

Safe harbour

FounderCatalyst will not pursue civil or criminal legal action against security researchers who:

Act in good faith and in accordance with this policy
Avoid accessing, modifying, or deleting data belonging to other users - if you accidentally access another user's data, stop immediately and report what you found
Do not publicly disclose the vulnerability before we have had a reasonable opportunity to investigate and remediate (we ask for a minimum of 90 days from the date of your report)
Do not degrade the availability or performance of our services
Do not exploit a vulnerability beyond what is necessary to demonstrate it exists
Comply with all applicable laws

We consider security research conducted in line with this policy to be authorised activity. We will not report good-faith researchers to law enforcement.

If at any point you are uncertain whether your actions are consistent with this policy, please reach out to us at security@foundercatalyst.com before proceeding.