security@buildcycle.io
One inbox, read by the person who writes the code. Machine-readable contact details are at /.well-known/security.txt.
SECURITY
Found something? Tell us.
BuildCycle holds the project record for architecture and engineering firms — their RFIs, their submittals, their contracts, their photographs. If you have found a vulnerability, we want to hear it from you first, not from a customer.
WHERE TO SEND IT
WHAT HAPPENS NEXT
A reply in one business day
You get a human, not an auto-responder. Our assessment and a fix timeline follow within five business days, and we tell you when it ships.
WHAT TO INCLUDE
Steps we can repeat
The URL or endpoint, what you did, what you saw, and roughly when. One reproducible proof of concept is worth more than a scanner export.
SAFE HARBOR
Report in good faith and we will not come after you.
Our commitment to you
We will not pursue legal action, or ask anyone else to, against a researcher who reports a vulnerability in good faith and follows the rules below. We will not demand you stay silent — publish once it is fixed, and we will credit you if you want the credit.
The rules that keep it good faith
Test only against your own account and your own data. Do not access, change, or delete anyone else’s. Stop as soon as you have confirmed the issue — one record is proof, a thousand is a breach. Do not degrade the service for anyone else: no load testing, no denial of service, no spam. No social engineering of our people or our customers, and no physical intrusion. Give us reasonable time to fix the issue before you publish.
What is in scope
buildcycle.io, app.buildcycle.io, admin.buildcycle.io, and the APIs behind them.
What is out of scope
Our vendors’ own infrastructure — report those to the vendor directly. Findings with no demonstrated impact, such as missing headers, version banners, or raw scanner output. Denial of service and volumetric testing. Phishing or spam aimed at our users. Anything that needs physical access to a device or an already-compromised machine.
Is there a bounty?
No. We do not run a paid bug bounty, and we would rather say so than advertise one we cannot staff. What you get instead is a fast, honest answer from the developer, a fix, and credit if you want it.
BuildCycle, LLC — Oklahoma, USA. For anything that is not a security issue, use support. See our Terms of Service and Privacy Policy.