Security

Responsible Disclosure Policy

We take security seriously. If you've found a vulnerability in PredictHQ's systems, we want to hear from you.

Our commitment to you

Security researchers who report vulnerabilities in good faith can expect:
  • Prompt acknowledgment
    We'll confirm receipt of your report within 7 business days.
  • Confidentiality
    We won't share your name or contact details without your explicit consent.
  • No legal action
    We will not pursue legal action against researchers who follow this policy in good faith.

Scope

We welcome reports covering PredictHQ-owned systems and services.

In scope

  • PredictHQ API (api.predicthq.com)
  • PredictHQ web application (control.predicthq.com)
  • Authentication and authorization flows
  • Data exposure or leakage affecting customer data
  • Significant misconfigurations with a clear security impact

Out of scope

  • Denial-of-service attacks (DoS / DDoS) or volumetric testing
  • Social engineering or phishing of PredictHQ staff
  • Physical security
  • Third-party services or infrastructure we do not own
  • Vulnerabilities requiring unlikely user interaction or complex attack chains with negligible real-world impact
  • Automated scanner output submitted without manual validation
  • Missing HTTP security headers without a demonstrated impact
  • Rate limiting or brute-force issues on non-sensitive endpoints

Ground rules

To qualify for safe harbor under this policy, you must:
  • Not access or modify data that isn't yours. Use test accounts and synthetic data only.
  • Not disrupt production services. Avoid automated scanning, load generation, or anything that degrades availability for other customers.
  • Keep the issue private. We ask that you do not disclose the vulnerability publicly. We will aim to resolve valid reports within 90 days of acknowledgment and will keep you informed of progress throughout.
  • Report in good faith. Your goal should be to improve security, not to gain unauthorized access or extract data.

What we'd like in your report

A clear, reproducible report helps us triage faster. Please include:
  • A description of the vulnerability and its potential impact
  • Step-by-step reproduction instructions
  • The affected URL, endpoint, or component
  • Any supporting evidence (screenshots, HTTP request/response logs, proof-of-concept code)
  • Your assessment of severity (Critical / High / Medium / Low)
What happens after you report

Day 1-7

We acknowledge receipt and confirm whether the report is in scope.

Day 4-14

Our security team triages the report, assesses severity, and begins remediation planning.

Ongoing

We'll keep you updated as we work through the issue. Some fixes take longer than others.

Resolution

We'll let you know once the issue has been resolved.

Hall of Fame

We're grateful to the researchers below who have responsibly disclosed vulnerabilities and helped make PredictHQ more secure. Listed with their permission.

No entries yet — yours could be the first.

No monetary rewards

PredictHQ does not operate a paid bug bounty program. We do not offer cash, credits, or gifts in exchange for reports. We do genuinely appreciate responsible disclosure and will acknowledge your contribution if you'd like.

Contact

Send your report to our security team. Please encrypt sensitive details if you're able to.
security@predicthq.com

Last updated June 2026