Vulnerability Disclosure Policy

Email sounds@soundseam.com with the subject Security report. Please do not open a public issue or send live credentials, access tokens, or personal information.

A useful report includes:

• The affected URL, API route, feature, or component.
• A concise description of the issue and likely impact.
• Reproduction steps, prerequisites, and whether the result is repeatable.
• Sanitized evidence, relevant timestamps and time zone, and any suggested mitigation.
• Your disclosure plans and how you prefer to be credited.

This policy covers the SoundSeam web application and first-party APIs that SoundSeam owns and operates on soundseam.com or a SoundSeam-operated subdomain. It includes security issues in account, marketplace, order, file, collaboration, and public content features served by those systems.

If you are unsure whether an asset is operated by SoundSeam, contact us before testing it.

Third-party services are not authorized targets under this policy. This includes checkout and payment providers, cloud and infrastructure providers, analytics and marketing services, and websites or accounts operated by SoundSeam users. You may report a flaw in how SoundSeam integrates with a provider, but do not test the provider itself without its permission.

Reports limited to content disputes, spam, missing security headers without a demonstrated impact, self-XSS, or automated scanner output without a reproducible security consequence may not be treated as vulnerabilities.

During research, please:

• Use accounts, orders, content, and payment methods you own or are expressly authorized to test.
• Use the minimum requests and data needed to confirm the issue, at a rate that does not degrade the service.
• Stop testing and report promptly if you encounter another person's data or gain unintended access.
• Minimize any data you encounter, do not retain or share it, and delete local copies after we confirm they are no longer needed for the report.

Do not:

• Disrupt service, perform denial-of-service or high-volume testing, deploy malware, or establish persistence.
• Use social engineering, phishing, spam, physical intrusion, credential stuffing, or password guessing.
• Access another person's account, private order, files, messages, or personal information beyond the minimum accidental access needed to recognize and report the issue.
• Modify or delete data, make fraudulent transactions, interfere with purchases or payouts, or cause financial or privacy harm.
• Publicly disclose or sell vulnerability details while coordinated disclosure is in progress.

Give SoundSeam a reasonable opportunity to validate, investigate, and address a report before publication. Remediation timing depends on the issue's severity, complexity, and affected systems. Please coordinate publication with us and give advance notice if your disclosure plans change.

SoundSeam does not currently offer a bug bounty or other payment for reports. Submitting a report does not create a contract or a promise of a particular response, remediation, confidentiality, or disclosure outcome.

If we conclude that your research followed this policy and was intended in good faith to improve SoundSeam's security, SoundSeam will not initiate legal action based solely on that research. If a concern arises, contact us so we can try to resolve it.

This statement applies only to conduct within SoundSeam's authority. It does not authorize unlawful activity, bind third parties or law enforcement, provide immunity, or waive rights unrelated to compliant research.