Responsible disclosure

Email security@onsanctions.com with:

• the affected URL, endpoint or component;
• a description of the issue and its impact;
• the steps to reproduce it, with any request IDs;
• how you would like to be credited, if at all.

• Use only accounts and test keys you created yourself. Don't access, change or delete data that isn't yours; if you reach it by accident, stop and tell us.
• Don't run denial-of-service tests or high-volume automated scans, and stay within the published rate limits.
• Don't use social engineering, phishing or physical attacks against us, our customers or our providers.
• Don't disclose the issue publicly or to anyone else until we have fixed it and agreed a date with you.

In scope: onsanctions.com, the API under /v1, the MCP server and the account area.

Out of scope:

• services run by our providers, such as Stripe Checkout, Cloudflare or VerifyNow; report those to them;
• reports from automated scanners without a demonstrated impact;
• missing security headers or best practices without a working attack;
• clickjacking on pages with no sensitive action, self-XSS, and logout CSRF;
• email spoofing or SPF/DMARC settings, and denial of service.

• We acknowledge your report within three business days.
• We assess it, keep you updated, and tell you when it is fixed.
• With your permission, we credit you when we publish the fix.
• We don't run a paid bug bounty.

If you act in good faith and follow this policy, we will not take legal action against you or ask the authorities to, and we will treat your research as authorized. If a third party takes action against you for research under this policy, we will make it known that you acted with our permission.