Vulnerability Disclosure Policy
We take security seriously. If you've found a vulnerability in Outerank, we want to hear about it — and we'll work with you to fix it.
Report a vulnerability
Email security@outerank.com with a clear description, reproduction steps, and any relevant proof-of-concept.
We reply within 3 business days. See security.txt for the machine-readable version.
Scope
All of outerank.com, geo.outerank.com, and the Outerank API. Third-party services (Stripe, Google, Cloudflare, Resend, Anthropic) are out of scope — report those to the respective vendor.
What we ask of you
- • Do not access data that isn't yours. If you accidentally do, stop and let us know.
- • Do not degrade our service — no automated high-rate fuzzing, no denial-of-service.
- • Do not phish, socially engineer, or attack our employees.
- • Give us reasonable time to fix before public disclosure (30–90 days depending on severity).
What we do in return
- • Acknowledge your report within 3 business days.
- • Keep you updated on our progress.
- • Credit you publicly (if you want) once the fix ships.
- • Never take legal action against good-faith researchers who follow this policy.
Bounties
Outerank does not currently run a paid bounty program. We can offer public credit and swag for high-impact findings.