Vulnerability Disclosure Policy

Last updated: July 2nd, 2026

Introduction

Fullpath Ltd. (hereby “Fullpath”) is committed to ensuring the security of the public by protecting their information. This policy is intended to give security researchers clear guidelines for conducting vulnerability discovery activities and to convey our preferences in how to submit discovered vulnerabilities to us.

This policy describes what systems and types of research are covered under this policy, how to send us vulnerability reports, and our requirements regarding public disclosure of vulnerabilities.

We encourage you to contact us to report potential vulnerabilities in our systems.

Authorization

If you make a good faith effort to comply with this policy during your security research, we will consider your research to be authorized, we will work with you to understand and resolve the issue quickly, and Fullpath will not recommend or pursue legal action related to your research. This includes claims under our Terms of Service and claims related to circumvention of security controls, to the extent the activity was conducted in accordance with this policy. Should legal action be initiated by a third party against you for activities that were conducted in accordance with this policy, we will make this authorization known.

This authorization applies only to Fullpath’s own systems. It does not extend to any third party, and we cannot authorize testing of systems we do not own or control.

Guidelines

Under this policy, “research” means activities in which you:

• Notify us as soon as possible after you discover a real or potential security issue.
• Make every effort to avoid privacy violations, degradation of user experience, disruption to production systems, and destruction or manipulation of data.
• Test only against accounts that you own or that we have provided to you. Do not access, modify, or attempt to access other customers’ or users’ accounts or data. If you need a test account, contact us at security@fullpath.com.
• Only use exploits to the extent necessary to confirm a vulnerability’s presence. Do not use an exploit to compromise or exfiltrate data, establish persistent command line access, or use the exploit to pivot to other systems.
• Do not disclose the issue publicly without our prior written consent (see “Public disclosure” below).
• Verify every finding yourself before reporting it, and do not submit a high volume of low-quality reports.

Once you’ve established that a vulnerability exists or encounter any sensitive data (including personally identifiable information, financial information, or proprietary information or trade secrets of any party), you must stop your test, notify us immediately, and not disclose this data to anyone else. Do not retain, copy, or share any such data, and delete anything you have collected once you have notified us.

Public disclosure

We ask that you do not publicly disclose any details of a vulnerability or your research without our prior written consent. This applies from the moment you discover the issue and continues after it has been resolved. If you would like to publish, please contact us at security@fullpath.com and we will consider your request in good faith.

Test methods

The following test methods are not authorized:

• Network denial of service (DoS or DDoS) tests or other tests that impair access to or damage a system or data
• Physical testing (e.g. office access, open doors, tailgating), social engineering (e.g. phishing, vishing), or any other non-technical vulnerability testing
• Intensive intrusive tests (e.g. SQLi that could drastically increase CPU load or crash a database)
• Automated scanning or fuzzing at a rate above 10 requests per second per host. Automated tools are permitted within this limit, but their raw output is not a report (see “Issue Types” below).
• Accessing, modifying, or attempting to access data or accounts that do not belong to you

Issue Types

Please do not contact us for the following issue types:

• AI-generated or unverified reports. This includes reports written or assembled by AI tools (LLMs) or other automation that were not manually verified, and reports containing hallucinated vulnerabilities, fabricated code or functions, invented endpoints, or proof-of-concept steps that do not work. You may use AI tools to assist your research, but you are responsible for reproducing each finding yourself and for the accuracy of your report. Reports of this kind may be closed without a response, and repeated submissions may result in you being barred from reporting to us.
• Reports that state that software is out of date or vulnerable without a proof of concept
• Third-party library or dependency CVEs without a working proof of concept showing impact on our systems
• Highly speculative reports about theoretical damage. Be concrete.
• Vulnerabilities as reported by automated tools without additional analysis as to the real impact
• Low severity issues that can be detected with tools such as Security Headers
• Cross-site Request Forgery (CSRF) with minimal security implications (Logout CSRF, etc.)
• Missing cookie flags, unless you can demonstrate real impact
• UI and UX bugs (including spelling mistakes)
• Stack traces or error messages, unless they disclose secrets or sensitive data
• Open ports without an accompanying proof-of-concept demonstrating vulnerability
• Banner grabbing issues
• robots.txt disclosure
• Lack of SPF, DKIM, or DMARC records
• Clickjacking on pages without sensitive actions
• Self-XSS, or XSS that cannot be triggered against another user
• Username or email enumeration
• Missing rate limiting on non-sensitive endpoints
• TLS/SSL configuration findings (e.g. cipher suites, protocol versions) without demonstrated impact
• Content spoofing and text injection without a demonstrated attack
• Host header issues without demonstrated impact
• Findings that require a rooted or jailbroken device, physical access to a device, or a man-in-the-middle position
• Reports that depend on social engineering of our employees, customers, or vendors

Scope

This policy applies to the following systems and services:

• *.fullpath.com
• *.autoleadstar.com
• *.40nuggets.com

Any service not expressly listed above, such as any connected services, is excluded from scope and is not authorized for testing. Subdomains within the domains above that are hosted or operated by third parties (for example, our marketing website, help center, or status page) are also out of scope. Vulnerabilities found in systems from our vendors fall outside of this policy’s scope and should be reported directly to the vendor according to their disclosure policy (if any). If you aren’t sure whether a system is in scope or not, contact us at security@fullpath.com before starting your research.

Though we develop and maintain other internet-accessible systems or services, we ask that active research and testing only be conducted on the systems and services covered by the scope of this document. If there is a particular system not in scope that you think merits testing, please contact us to discuss it first. We will increase the scope of this policy over time.

Eligibility

Current and former Fullpath employees and contractors, and anyone prohibited from engaging with us under applicable sanctions or export laws, are not eligible for the authorization described in this policy.

Reporting a vulnerability

Information submitted under this policy will be used for defensive purposes only – to mitigate or remediate vulnerabilities. If your findings include newly discovered vulnerabilities that affect all users of a product or service and not solely Fullpath, we may share your report with the Cybersecurity and Infrastructure Security Agency, where it will be handled under their coordinated vulnerability disclosure process, or with other relevant national CERTs or coordination bodies. We will not share your name or contact information without express permission.

We accept vulnerability reports via security@fullpath.com. Reports may be submitted anonymously. If you share contact information, we will acknowledge receipt of your report within 3 business days.

We do not support PGP-encrypted emails. Please do not include sensitive customer data in your report; describe it instead, and we will tell you how to share anything further.

What we would like to see from you

In order to help us triage and prioritize submissions, we recommend that your reports:

• Describe the location the vulnerability was discovered and the potential impact of exploitation.
• Offer a detailed description of the steps needed to reproduce the vulnerability (proof of concept scripts or screenshots are helpful).
• Be in English, if possible.

What you can expect from us

When you choose to share your contact information with us, we commit to coordinating with you as openly and as quickly as possible.

• Within 3 business days, we will acknowledge that your report has been received.
• To the best of our ability, we will confirm the existence of the vulnerability to you and be as transparent as possible about what steps we are taking during the remediation process, including on issues or challenges that may delay resolution.
• We will keep you updated on progress at least every 30 days until the issue is resolved.
• We will maintain an open dialogue to discuss issues.

Rewards and recognition

We do not currently offer monetary rewards or bounties for vulnerability reports. If you would like, we are happy to acknowledge your contribution by name once the issue has been resolved. Where several researchers report the same issue, credit goes to the first valid report we receive.

Questions

Questions regarding this policy may be sent to security@fullpath.com. We also invite you to contact us with suggestions for improving this policy.