Vulnerability disclosure policy

Last updated 2 October 2026.

If you believe you have found a security vulnerability in MergeSafe, we want to hear about it. This page describes what is in scope, how to report it, and the safe harbor we offer for good-faith research.

Scope

In scope:

• mergesafe.ai and its subdomains (including app.mergesafe.ai).
• The MergeSafe GitHub App and its webhook endpoints.

Not allowed, on any target:

• Testing against other customers’ data or accounts. Use your own test organization and repositories.
• Denial of service or load testing.
• Social engineering of our staff, contractors or users.
• Physical attacks against our offices, staff or facilities.

Safe harbor

We will not pursue legal action against researchers who make a good-faith effort to comply with this policy: staying in scope, avoiding the activity listed above, and reporting what you find rather than exploiting it further (no accessing, modifying or exfiltrating data beyond what is needed to demonstrate the issue). If a third party initiates legal action over research conducted under this policy, we will make it known that your activity was authorized.

How to report

Email support@mergesafe.ai with what you found, the steps to reproduce it, and its impact. We do not have a dedicated security mailbox yet; this one reaches us directly. Encrypting your report is not required.

We will acknowledge your report within 3 business days. We do not currently offer a paid bounty, but we will credit researchers who ask to be named once a fix has shipped.

Learn more

• Security & compliance: our security practices and SOC 2 status.
• What our security review checks on every pull request.
• Subprocessors: who else processes data on our behalf.