SwingVantage is committed to keeping our users' data safe. We welcome responsible disclosure of security vulnerabilities. If you discover a security issue, we ask that you follow this coordinated disclosure process so we can fix it before it affects users.
Please do not open a public GitHub issue for security vulnerabilities. Public disclosure before remediation puts our users at risk.
How to Report
1. Contact Us Privately
Email the details to our security team. Do not open a public GitHub issue, post on social media, or disclose the vulnerability before we have had a chance to investigate and remediate.
2. We Acknowledge Within 48 Hours
We will confirm receipt of your report within 48 hours and provide an initial assessment within 5 business days.
3. We Investigate and Fix
Confirmed vulnerabilities will be remediated within 30 days for critical/high severity, and within 90 days for medium/low severity.
4. We Coordinate Disclosure
We will coordinate public disclosure timing with you. We are happy to credit your discovery in our release notes if you would like to be acknowledged.
Contact
Send your vulnerability report to our security team:
security@swingvantage.com
(Replace this placeholder with your real security email before public launch — see SECURITY.md at the repository root.)
What to Include in Your Report
- ✓A clear description of the vulnerability
- ✓Step-by-step instructions to reproduce it
- ✓The potential impact on users
- ✓Any proof-of-concept code or screenshots (optional but helpful)
- ✓Your suggested fix or remediation (optional)
- ✓Whether you would like to be credited publicly
✓In Scope
- •Authentication bypass or session hijacking
- •Unauthorized access to other users' data (IDOR)
- •SQL injection or database exposure
- •Cross-site scripting (XSS) that affects other users
- •Server-side request forgery (SSRF)
- •Remote code execution
- •Sensitive data exposure (API keys, user PII)
- •Broken access control in API routes
✗Out of Scope
- •Denial of service (DoS/DDoS) attacks
- •Social engineering or phishing attacks
- •Vulnerabilities in third-party services we use (report directly to them)
- •Issues requiring physical access to a device
- •Automated scanner results without proof of exploitability
- •Rate limiting that does not lead to account compromise
- •Missing security headers with no demonstrated impact
- •Issues in non-current browsers or operating systems
Safe Harbor
We will not pursue legal action against security researchers who:
- Follow this coordinated disclosure policy
- Make a good-faith effort to avoid accessing or modifying other users' data
- Do not perform denial-of-service attacks
- Do not use findings for personal gain beyond recognition
This safe harbor applies to security research conducted in good faith under this policy. It does not apply to attackers who exploit vulnerabilities for malicious purposes.
Response Timelines
| Severity | Acknowledgment | Target Fix |
|---|---|---|
| Critical | 48 hours | 7 days |
| High | 48 hours | 30 days |
| Medium | 48 hours | 60 days |
| Low | 48 hours | 90 days |