bloomsocial site logo

Vulnerability Disclosure Policy

Vulnerability Disclosure Policy

Last updated: October 26, 2026

At BloomSocial AI, we take the security of our platform, systems and customer data seriously. We recognize the important role that security researchers and the wider security community play in identifying vulnerabilities.

We welcome responsible reports of potential security vulnerabilities affecting BloomSocial AI and are committed to reviewing credible reports and addressing validated issues as appropriate.

This policy explains how to report a potential vulnerability, the scope of permitted research, and the principles we ask researchers to follow.

Scope

This policy covers publicly accessible systems and services operated by BloomSocial AI, including:

  • The BloomSocial AI website at bloomsocial.ai.
  • The BloomSocial AI application and associated web interfaces.
  • APIs and backend services operated by BloomSocial AI.
  • Authentication, authorization and account-management functionality.
  • Security controls governing the handling and processing of customer data.

Vulnerabilities in third-party services, infrastructure or platforms are outside the scope of this policy unless the reported issue concerns BloomSocial AI’s own implementation or integration with those services. Please report vulnerabilities affecting third-party products directly to their respective providers.

How to report a vulnerability

Please email contact@bloomsocial.ai with the subject line Security Vulnerability Report.

 

Include the following information where applicable:

  • A description of the potential vulnerability and its security impact.
  • The affected URL, endpoint, feature or service.
  • Clear steps to reproduce the issue.
  • Proof-of-concept details, screenshots or relevant technical evidence.
  • Any prerequisites required to reproduce the issue.
  • Your preferred contact information, if you would like us to follow up.

Please do not include passwords, access tokens, API keys, personal data or other sensitive information in your initial email. If further evidence is required, we will coordinate an appropriate way to receive it.

 

Responsible research guidelines

When investigating or reporting a potential vulnerability, we ask researchers to:

  • Act in good faith and limit testing to what is necessary to establish the existence and impact of a vulnerability.
  • Use accounts and data they own or are explicitly authorized to access.
  • Avoid accessing, modifying, deleting, disclosing or exfiltrating other users’ data.
  • Avoid disrupting services, degrading availability or affecting other customers.
  • Stop testing and notify us if sensitive data is encountered or there is a risk of harm.
  • Keep vulnerability details confidential while we investigate and work toward remediation.
  • Not conduct social engineering, phishing, physical intrusion, denial-of-service testing or destructive testing.

Do not attempt to access systems, accounts, data or environments beyond what is necessary for authorized, good-faith research.

What happens after you report an issue?

We will review reports submitted through the contact channel above and assess their validity, severity, potential impact and remediation requirements.

Where appropriate, we may contact the reporter for additional information, investigate the issue, implement corrective measures and provide an update on the outcome.

Response and remediation timelines may vary depending on the nature, severity and complexity of the issue. Submission of a report does not guarantee a particular response time or resolution date.

Coordinated disclosure

Please do not publicly disclose a vulnerability or publish technical details that could expose BloomSocial AI, its customers or other users to risk before coordinating with us.

We ask researchers to allow a reasonable period for investigation and remediation and to work with us in good faith toward responsible disclosure. Any proposed public disclosure should be discussed with us in advance.

Recognition and rewards

BloomSocial AI welcomes responsible vulnerability reports. Submission of a vulnerability report does not entitle the reporter to payment, a bounty or other compensation. Any recognition or reward, if offered, will be subject to separate written confirmation.

Policy limitations

This policy does not authorize access to systems or data that you do not own or have permission to access, nor does it override applicable law or third-party terms.

BloomSocial AI reserves the right to update this policy as its products and security practices evolve.

Contact

For vulnerability reports or questions about this policy, contact:

BloomSocial AI