ClearCast

Responsible Disclosure

We welcome reports from security researchers. If you believe you've found a vulnerability in ClearCast, please tell us so we can fix it and protect our customers.

How to report

Email security@clear-cast.net with a description of the issue, the steps to reproduce it, and any proof-of-concept. We aim to acknowledge reports within 5 business days.

Safe harbor

We will not pursue legal action against researchers who, in good faith:

• Make a reasonable effort to avoid privacy violations, data destruction, and service disruption.
• Only access or modify data that belongs to their own test account.
• Give us reasonable time to remediate before public disclosure.
• Do not exploit the issue beyond what's necessary to demonstrate it.

Please do not

• Access, modify, or delete other customers' data.
• Run automated scans that degrade the service, or perform denial-of-service testing.
• Use social engineering, phishing, or physical attacks against our staff or infrastructure.

Scope

The ClearCast web application and its API (clear-cast.net). Issues in third-party platforms we integrate with (Meta, Google, X, etc.) should be reported to those providers.

We don't currently run a paid bug-bounty program, but we genuinely appreciate disclosures and will credit researchers who wish to be acknowledged.