Vulnerability disclosure

If you have found a security issue in this site or in Sabia, we want to hear about it, and we will treat you like the person doing us a favour that you are.

How to report

Email security@sabiapartners.ca with enough detail to reproduce the issue. A proof of concept is welcome; access to other people’s data is not. If you stumble into any, stop and tell us what happened. This policy is also published at /.well-known/security.txt.

What we promise

• An acknowledgement within 3 business days.
• An honest assessment and a timeline once we have reproduced the issue.
• Credit, if you want it, when the fix ships.
• No legal action for good-faith research that respects the rules below.

Rules of engagement

• Do not access, modify or destroy data that is not yours.
• No denial of service, spam, or social engineering of our people.
• Do not run automated scanners against the waitlist endpoint. It emails real people.
• Give us reasonable time to fix an issue before publishing it.