Security & Responsible Disclosure

Last Updated: July 30, 2026

Reporting an issue

Email security@featureboard.ai. Machine-readable contact details are published at /.well-known/security.txt.

Please include enough detail to reproduce the issue: the affected URL or endpoint, the steps, and what an attacker gains. A report we cannot reproduce is a report we cannot fix.

What we pay

We do not operate a paid bug bounty program. FeatureBoard Labs is a small team and does not pay for reports.

We read every report with a specific, reproducible finding, fix what is real, and credit you publicly on this page if you want that. If you are looking for a paid bounty, this is not the right target.

Scope

In scope:

featureboard.ai and its subdomains
The public API endpoints under /api/
The FeatureBoard MCP server and plugin distributed from this site

Out of scope:

The demos under /examples/ — these are sandboxed copies of open-source projects, served as static files, holding no credentials or user data
Findings from automated scanners with no demonstrated impact — in particular, missing security headers on pages that hold nothing sensitive, version-disclosure banners, and the absence of DNSSEC or CAA records
Reports that an email address is discoverable, or that a rate limit exists but is generous
Social engineering, physical access, and denial of service
Third-party services we consume (Cloudflare, Polar, Resend) — please report those to their own programs

What we ask

No automated scanning against production. On shared infrastructure a scan is indistinguishable from an attack, and it costs real time to investigate.
Do not access, modify, or exfiltrate data that is not yours. If a proof of concept requires touching someone else's data, stop and describe the issue instead — a clear description is sufficient.
Give us a reasonable window to ship a fix before publishing.

What to expect back

We acknowledge reports within 5 business days and tell you within 30 days what we have done, or why we decided not to act. Those are targets, not a contractual SLA.

If you report something real and would like credit, tell us the name and link you would like used and we will add it here.

Safe harbour

If you make a good-faith effort to follow this policy, we will not pursue legal action over your research, and we will work with you to understand and resolve the issue quickly. Good faith means staying in scope, avoiding privacy violations and service degradation, and not extorting us for payment.

Contact

Security: security@featureboard.ai
Everything else: sales@featureboard.ai