Security Policy

Reporting a Vulnerability

If you discover a security vulnerability in Tadpole, please report it responsibly.

Contact: security@tadpole.club

Please include:

• Description of the vulnerability
• Steps to reproduce
• Potential impact
• Any suggested fixes (optional)

Response Commitment

• Acknowledge your report within 48 hours
• Provide an update within 7 days with our assessment and remediation plan
• Notify you when the fix is deployed

Scope

In scope:

• tadpole.club and all club subdomains
• API endpoints
• Member-facing pages and token URLs
• Authentication and authorization logic
• Row-Level Security policy bypasses
• Cross-tenant data leakage

Out of scope:

• Third-party services (Stripe, Supabase, Brevo, Vercel) — report directly to those providers
• Social engineering attacks against club administrators
• Denial of service attacks
• Issues in dependencies with no demonstrated impact on Tadpole

Disclosure Policy

• Please do not publicly disclose the vulnerability until we have had a chance to address it
• We aim to resolve critical issues within 7 days and high-severity issues within 30 days
• We will coordinate public disclosure timing with you

Credit

We appreciate security researchers who help keep Tadpole and its club members safe. With your permission, we will acknowledge your contribution in our release notes.