If you believe you’ve found a security vulnerability in LeadForGrow, please tell us privately first so we can protect our customers. We welcome reports from researchers acting in good faith.
1. Scope
In scope
- www.leadforgrow.com and leadforgrow.com
- The LeadForGrow app (/automation) and its API routes
- Public forms, booking pages and the website chat widget
Out of scope
- Social engineering or phishing of our team or customers
- Physical attacks
- Denial-of-service or load testing
- Third-party services we use (report those to the vendor)
2. What happens after you report
- 1
Report privately
Email security@leadforgrow.com with a description, steps to reproduce and the impact you observed.
- 2
We acknowledge
We aim to respond within 72 hours to confirm we have it.
- 3
We investigate
We reproduce the issue, assess severity and work on a fix, keeping you updated.
- 4
We fix and credit
Once fixed we let you know and, with your permission, thank you publicly.
3. Safe harbour
If you follow this policy, we will not pursue legal action against you for your research. In return, please:
- Act in good faith and avoid privacy violations, data destruction and service disruption.
- Access only your own accounts and data, and stop as soon as you reach someone else’s.
- Give us reasonable time to fix the issue before you disclose it publicly.
- Don’t include customer data in your report beyond what is needed to show the issue.
For a summary of our safeguards see the Security overview.