Security and vulnerability reporting
Protect people first. Preserve evidence.
GiveCircuit treats tenant isolation, least privilege, authentication, auditability, and safe recovery as product requirements.
Current controls
Organization administrators are scoped to their assigned workspace. Participant records carry organization identifiers, server routes bind access to the authenticated user and tenant, passwords use salted PBKDF2 hashes within the runtime limit, sessions expire, sign-in attempts are rate limited, and privileged activity is recorded.
Report a vulnerability
Use the GiveCircuit support path and clearly label the message “Security report.” Include affected routes, impact, reproduction steps, and a safe contact method. Do not access unrelated records, disrupt availability, publish private data, or demand payment by threatening disclosure.
Do not include secrets
Never send passwords, session tokens, API keys, payment credentials, private participant exports, or unnecessary personal information in an initial report.
Current limitations
Admin MFA, fine-grained organization RBAC, independent penetration testing, production restore evidence, and comprehensive automated security acceptance remain tracked launch gates.