Vulnerability Disclosure Policy
Usermuse, Inc., a Delaware public benefit corporation, doing business as Evermuse
Last Updated: October 8, 2026
1. Our Commitment
Protecting customer data is core to what we do. We welcome reports from security researchers and anyone who believes they have found a vulnerability in Evermuse. We will work with you in good faith to understand and resolve the issue quickly.
2. How to Report
Email security@evermuse.com with the details below. Please do not open public issues or post details before we have had a chance to respond.
A helpful report includes:
- A description of the vulnerability and its potential impact
- The affected URL, endpoint, or feature
- Step-by-step instructions to reproduce, including any proof-of-concept code or screenshots
- Your contact details, and whether you would like to be credited
3. Scope
In scope:
- evermuse.com and its subdomains operated by Evermuse
- The Evermuse web application
- The Evermuse MCP server and APIs
Out of scope:
- Third-party services we integrate with (report those to the vendor)
- Social engineering or phishing of Evermuse employees or customers
- Physical attacks against offices or data centers
- Denial-of-service or volumetric testing
- Findings without a demonstrable security impact, such as missing best-practice headers on static pages, or reports from automated scanners without validation
4. Safe Harbor
If you act in good faith and follow this policy, we will not pursue legal action against you or ask law enforcement to do so. Good faith means you:
- Make every effort to avoid privacy violations, data destruction, and service disruption
- Only interact with accounts you own or have explicit permission to test
- Stop testing and report immediately if you access customer data, and do not retain, share, or exfiltrate it
- Do not exploit a vulnerability beyond what is needed to demonstrate it
- Give us a reasonable time to fix the issue before any public disclosure
5. What to Expect
- Acknowledgement: we aim to confirm receipt within 3 business days.
- Triage: we will assess severity and keep you updated on progress.
- Resolution: we will notify you when the issue is fixed and, with your permission, credit you for the finding.
We do not currently operate a paid bug bounty program, but we are grateful for every responsible report.
6. Related Resources
Questions about this policy? Contact security@evermuse.com.