Our Commitment

Collars connects applicants, employers, and schools, and we take the security of their data seriously. We welcome reports from the security community and appreciate everyone who helps us keep Collars safe by reporting issues responsibly.

This policy explains how to report a vulnerability, what you can expect from us, and the rules we ask you to follow while researching.

Scope

In scope

• collars.io and www.collars.io
• app.collars.io
• employer.collars.io
• schools.collars.io
• The Collars Admin Portal
• Backend APIs that serve the applications above
• Staging versions of the above

[PENDING: confirm full public host list, including Admin Portal, API, and staging hostnames. Keep this list in sync with the security.txt Canonical entries.]

Out of scope: assets

• Third-party services Collars uses. Please report those directly to the vendor.
• Client-side issues in the Collars mobile app itself. The APIs the mobile app calls remain in scope.

Out of scope: vulnerability types

• Volumetric denial of service
• Social engineering or phishing of Collars staff
• Physical attacks against Collars offices or equipment
• Spam, or reports generated by automated scanners without a demonstrated impact
• Missing best-practice headers or settings with no demonstrated impact

Supported Versions

Collars is a hosted service. Only the current production deployment and our staging environments are supported.

How to Report a Vulnerability

Email security@collars.io.

If you have not received a response within 5 business days, you may escalate to dgarcia@collars.io.

Please do not report security issues through social media, public forums, or our general support channels.

What to Include

To help us validate your report quickly, please include:

• The affected asset or URL
• The type of vulnerability
• Step-by-step instructions to reproduce it
• A proof of concept, if you have one
• The impact: what an attacker could do with it
• Your contact information and the name you would like us to use when thanking you
• Whether you have shared this issue with anyone else

What to Expect

• Acknowledgment: within 5 business days of your report.
• Validation and initial severity assessment: within 2 business days of acknowledgment.
• Status updates: at least every 14 days while your report is open, and at key milestones: when the report is validated or declined, when a fix is deployed, and when disclosure timing is agreed.

We rate validated reports as High, Medium, or Low severity and aim to resolve them within these timeframes, counted in calendar days from validation:

• High: mitigated within 3 days, fully fixed within 14 days.
• Medium: fixed within 30 days.
• Low: fixed within 90 days, or on a best-effort basis.

Rules for Security Research

Publishing this policy does not by itself authorize testing. The rules below define what is permitted.

• Only use accounts you created yourself through our normal sign-up process. Collars does not provide test accounts.
• Do not access, modify, delete, or retain data belonging to other users.
• If you encounter personal data, including applicant or student information, stop immediately, do not copy or store it, and report it to us right away.
• Do not degrade service for other users.
• Do not perform intrusive or destructive testing, in production or staging.
• Automated scanning is not permitted without prior written permission from Collars.

[PENDING: reconcile the automated scanning rule and Terms of Service language with the safe harbor terms below. disclose.io's terms waive ToS restrictions for good-faith research, so the two must agree on what is authorized. Also align the personal data wording with the SOPPA work.]

Safe Harbor

[PENDING: legal review, on hold until new counsel is in place. Draft adapted from disclose.io's standard terms goes here. Placeholder intent below.]

If you make a good-faith effort to comply with this policy during your research, Collars will consider your research authorized, will not pursue legal action against you, and will not ask law enforcement to investigate you.

Coordinated Disclosure

Please do not share details of a vulnerability publicly until we have released a fix or 90 days have passed since your report, whichever comes first. If you believe a longer or shorter timeline is warranted, tell us and we will work it out with you.

[PENDING: approval of the no-public-advisories-by-default recommendation (Notion 3.9). Customer and district notification lives in a separate protocol and does not belong on this page.]

Recognition

Collars does not offer monetary rewards or a bug bounty at this time. We will personally thank every researcher whose valid report helps us improve.

Changes to This Policy

We may update this policy from time to time. The "Last Updated" date at the top of this page shows when it was last changed.