Responsible disclosure

Security

Last updated August 3, 2026

We appreciate good-faith reports that help us protect Harvest Forge products, users, and infrastructure.

Report a security concern

Email a concise description, affected product or URL, reproduction steps, and potential impact. Do not include real user data or secrets in your first message.

Email a security report

Good-faith testing

Do not access, modify, retain, or disclose another person’s data.
Do not disrupt service, degrade availability, send spam, or use social engineering.
Do not perform physical testing or target employees, vendors, or users.
Stop testing and contact us if you encounter sensitive information.
Allow reasonable time for investigation before any public disclosure.

What to expect

We will review credible reports and may contact you for additional information. Harvest Forge does not currently operate a paid bug-bounty program and cannot promise compensation. This page does not authorize activity that violates law or third-party rights.