Security & Vulnerability Disclosure

How we protect your data

• Database row-level security isolates every organization.
• Test credentials and OAuth tokens are envelope-encrypted (AES-256-GCM).
• Two-factor authentication is required for owners and admins.
• Scan runners are isolated from the app and hold no database credentials.
• We scan our own production weekly with our Deep profile.

Report a vulnerability

Email security@emeraldredteam.com. Please include steps to reproduce. We'll acknowledge within 2 business days.

Safe harbor

We won't pursue legal action against good-faith research that avoids privacy violations, data destruction and service degradation, stays within your own accounts, and gives us reasonable time to fix issues before disclosure.