Polymorph Vulnerability Disclosure

generated: '2026-07-20'
method: searched
probe: true
source: https://usepolymorph.com/legal/security
policy:
- https://usepolymorph.com/legal/security
contact:
- founders@usepolymorph.com
summary: >-
  Polymorph publishes a Security Policy that includes a "Reporting a
  vulnerability" section welcoming reports from security researchers, asking for
  a reasonable opportunity to remediate before public disclosure and that
  researchers avoid accessing or modifying data that is not theirs. No bug
  bounty program or third-party platform (HackerOne/Bugcrowd/Intigriti) is
  advertised.
bug_bounty: false
disclosure:
  coordinated: true
  pre_disclosure_window: true
  scope_note: "Do not access or modify data that is not yours"
compliance_note: >-
  The same Security Policy states the company aligns with widely recognized
  security standards and data-protection laws including GDPR and CCPA. No named
  third-party certifications (SOC 2, ISO 27001, PCI DSS, HIPAA, FedRAMP) are
  published, so no Compliance/TrustCenter pointer is asserted.
evidence:
- source: https://usepolymorph.com/legal/security
  kind: security-policy
  keywords:
  - reporting a vulnerability
  - security researchers
  - responsible disclosure
  - incident response