Vulnerability Disclosure Policy

PurpletGo holds employee records and the credentials it uses to remove access in customers' systems, so we want to hear about any weakness in it. This policy explains how to report one, what we will do, and what we ask of you.

Last updated: October 9, 2026

How to report

Email security@purpletgo.com. Please do not report security issues in public GitHub issues, on social media, or through support chat.

Include:

• what the issue is and where: the URL, API endpoint or component
• steps to reproduce, with requests and responses, screenshots or a proof of concept
• the impact you believe it has, and what an attacker needs first (an account, a role, a plan)
• the account email or organization you tested with
• whether and how you would like to be credited

One issue per email helps us track each one.

What we commit to

Critical means an issue that lets an attacker, without help from the victim, read or change another organization's data, take over accounts, bypass sign-in, run code on our servers, or obtain stored secrets such as integration credentials or keys. We use CVSS v3.1 as a guide for everything else.

If a report shows that customer personal data was accessed, we also follow our incident response process, which includes telling affected customers within 72 hours of becoming aware of it.

Rules for testing

• Test only with accounts you created (a free trial works) or have written permission to use. Do not access, change or delete anyone else's data. If you reach data that is not yours, stop, do not keep or share it, and tell us in your report.
• Do not degrade the service: no denial of service, load testing or high-volume automated scanning. Keep automated tools to a low request rate.
• No social engineering of our staff or customers, no phishing, and no physical attacks.
• Do not use a vulnerability further than needed to show it: no pivoting to other systems, no persistence, no copying data out.
• Send email or SMS through the product only to addresses and numbers you own. Do not use self-service portal links that belong to real people.
• Give us reasonable time to fix the issue before you disclose it. We ask for 90 days from your report, or less once a fix is live and we agree on a date.

Scope

In scope:

• app.purpletgo.com: the web app and its API, including the public REST API (/api/v1), SCIM, SAML and inbound webhooks
• the employee self-service portal and alumni pages served by the app
• purpletgo.com (the marketing site) and docs.purpletgo.com
• the code in the PurpletGo repository

Out of scope:

• the services we use, such as Google Cloud, Cloudflare, Vercel, Stripe, and our email, SMS, AI and e-signature providers (report issues in them to the provider)
• the apps customers connect to PurpletGo, such as Okta, Google Workspace or Slack
• non-production environments, such as dev-app.purpletgo.com, unless we invite you to test them
• denial of service, volumetric attacks, and missing rate limits on endpoints that are not sensitive
• reports from automated scanners without a demonstrated impact
• missing security headers, cookie flags or email settings (SPF, DKIM, DMARC) without a demonstrated impact
• clickjacking on pages with no sensitive action, self-XSS, and logout CSRF
• issues that need a compromised device or an outdated browser
• issues we already know about (we will tell you if your report is a duplicate)

Safe harbor

If you make a good-faith effort to follow this policy:

• we consider your research authorized, and we will not bring or support legal action against you for it, including under anti-hacking laws such as the US Computer Fraud and Abuse Act, or anti-circumvention laws such as the DMCA
• the restriction on testing the Service in our Terms of Service (acceptable use) does not apply to testing that follows this policy
• if a third party brings legal action against you for activity that followed this policy, we will make it known that you acted under it

This policy does not authorize testing of third-party systems or anything that breaks the law. If you are unsure whether something is allowed, ask security@purpletgo.com before you do it.

Recognition

We do not run a paid bug bounty. With your permission, we will thank you by name when we announce the fix, if we announce it.

There is no PGP key for encrypted reports yet. Until one is published, send the minimum detail by email and we will arrange a secure way to share the rest.

Related pages

• Security & SSO