Vulnerability disclosure.

Emito Consulting Service LLC (“we”) values the work of security researchers. If you believe you have found a vulnerability in Holy, we want to hear from you, and we commit to working with you in good faith to understand and resolve it quickly. We do not currently run a paid bounty programme; with your permission we will credit you publicly once an issue is fixed.

In scope:

• ·holyplatform.com (this website)
• ·app.holyplatform.com and every church site or member portal it serves
• ·api.holyplatform.com (the Holy API, including /api/public/v1)
• ·docs.holyplatform.com
• ·The Holy mobile applications

Out of scope:

• ·Denial-of-service, load or resource-exhaustion testing of any kind
• ·Social engineering, phishing or physical attacks against our staff, customers or providers
• ·Vulnerabilities in third-party services we use (Stripe, Supabase, AWS, Cloudflare, Sentry, Cal.com) — report those to the vendor
• ·Findings that require a compromised or rooted device, or a man-in-the-middle position on the user’s network
• ·Reports from automated scanners without a demonstrated impact; missing best-practice headers with no exploit path; clickjacking on pages with no sensitive action; rate-limit findings on non-authentication endpoints

• ·Test only against accounts and churches you own or have explicit permission to test. Do not access, modify or delete data that is not yours; if you encounter another church’s data, stop, record only what is necessary to demonstrate the issue, and report it immediately.
• ·Do not degrade the service for others. Keep automated requests low-volume; do not run load tests.
• ·Do not exfiltrate, retain or share data beyond the minimum needed to demonstrate the vulnerability, and delete it once the report is closed.
• ·Do not exploit a finding beyond proof of concept, pivot to other systems, or persist access.
• ·Give us a reasonable time to fix the issue before disclosing it (see Coordinated disclosure).

Email security@holyplatform.com (or support@holyplatform.com if that address is unavailable). Our machine-readable contact record is at /.well-known/security.txt. Please include:

• ·The affected host and endpoint or page
• ·Steps to reproduce, with request/response detail or a short screen recording
• ·The impact you believe it has, and any prerequisites (role, plan, feature flag)
• ·Whether you have shared the finding with anyone else
• ·How you would like to be credited, or that you prefer to remain anonymous

• ·Acknowledgement within 3 business days.
• ·An initial triage and severity assessment within 10 business days, and a named contact for the report.
• ·A fix within our published remediation windows, counted from triage — critical within 15 days, high 30, medium 60, low 90 (see security advisories) — and a note when the fix ships.
• ·Public credit (with your consent) on this page once the issue is resolved.

Severity is assessed against impact on church data confidentiality and integrity first, then availability. Cross-tenant data exposure of any kind is treated as critical.

We ask that you keep the details of a report confidential until we have shipped a fix, or for 90 days from your report, whichever comes first — and that you talk to us before publishing if we need longer for a complex issue. We will not ask you to withhold publication indefinitely.

If you make a good-faith effort to comply with this policy, we will consider your research authorised, will not pursue or support legal action against you for it, and will work with you to understand and resolve the issue quickly. If a third party initiates legal action against you for activity conducted in accordance with this policy, we will make it known that your actions were authorised. This authorisation is limited to systems we control and does not extend to the third-party services listed as out of scope.

No public reports have been credited yet. Researchers who report a valid issue and consent to credit will be listed here.