Our commitment: Inner Circle values the work of independent security researchers in helping us keep our members safe. This policy explains how to report a suspected vulnerability and what to expect from us in return.
Scope
In scope: theinnercircle.co and its subdomains, the Inner Circle mobile apps (iOS/Android), and our public APIs.
Out of scope: third-party services we don't control, social-engineering or physical-security testing, denial-of-service testing, and automated scanning that degrades service for other users.
How to report
Email security@theinnercircle.com with: a description of the issue, steps to reproduce, the affected URL/endpoint or app version, and (if applicable) proof. Please do not include real member data in your report.
What we commit to
Acknowledge receipt within 5 business days.
Keep you informed of progress as we investigate and remediate.
Aim to remediate confirmed critical/high-severity issues without undue delay, and communicate a target timeline once triaged.
These figures are our own published commitment, following common industry practice — not a number mandated by the CRA itself.
Coordinated disclosure
We ask that you give us a reasonable period to investigate and remediate before any public disclosure — commonly up to 90 days, or shorter/longer by mutual agreement depending on severity and complexity.
Safe harbor
We will not pursue legal action against researchers who discover and report vulnerabilities in good faith, in accordance with this policy, and who do not access, modify, or exfiltrate member data beyond what's needed to demonstrate the issue.