Responsible Disclosure Policy

At Evident, we take the security of our platform and the data entrusted to us seriously. We value the work of security researchers who help us maintain the safety and privacy of our users. If you believe you have found a security vulnerability, we encourage you to report it to us responsibly.

Scope

This policy applies to vulnerabilities found in:

trustmind.com and its subdomains
Evident API endpoints

How to Report

Please send your findings to security@evident.security. Include as much detail as possible:

A description of the vulnerability and its potential impact
Step-by-step instructions to reproduce the issue
The affected URL, parameter, or component
Any proof-of-concept code or screenshots

What to Expect

Acknowledgment: You will receive an automated acknowledgment upon receipt of your report.
Response: We will provide a substantive response within 3 business days, including our assessment and expected timeline for remediation.
Updates: We will keep you informed of our progress toward resolving the issue.

Disclosure Timeline

We ask that you give us a reasonable amount of time to address the vulnerability before disclosing it publicly. We request a minimum of 90 days from the date of your report before any public disclosure.

Safe Harbor

We will not pursue legal action against security researchers who discover and report vulnerabilities in good faith and in accordance with this policy. We consider security research conducted under this policy to be authorized and will not initiate legal action for accidental, good-faith violations.

To qualify for safe harbor, researchers must:

Avoid actions that could harm Evident, our users, or our services
Not access, modify, or delete data belonging to other users
Stop testing and report the issue immediately upon discovering a vulnerability that exposes user data
Not disclose the vulnerability publicly until we have had a reasonable opportunity to address it

Out of Scope

To keep signal high, we only accept reports of concrete, reproducible, exploitable security vulnerabilities with a working proof-of-concept. Reports that consist of general security advice, hardening recommendations, or theoretical issues without demonstrated impact are not in scope and will generally be closed without individual response. The following categories are explicitly out of scope:

Best-practice, hardening, or "posture" recommendations without a demonstrated exploit — including missing or weak security headers, TLS/SSL cipher suite suggestions, SPF / DKIM / DMARC adjustments, HSTS preload status, CSP tightening, cookie flag suggestions, and similar configuration tweaks.
Automated scanner output submitted without manual validation and a concrete proof-of-concept demonstrating impact.
Theoretical or informational findings without a working exploit — including missing rate limits without demonstrated abuse, clickjacking on pages with no sensitive action, open redirects without downstream impact, and verbose error messages that don't leak sensitive data.
Self-XSS or any issue requiring the victim to paste attacker-controlled content into their own browser console, devtools, or URL bar.
Email enumeration, account existence disclosure, or other issues inherent to standard authentication flows without a further demonstrated exploit.
CSRF on endpoints that do not perform sensitive state-changing actions or that are already protected by SameSite cookies or framework-level tokens.
Subdomain takeover claims without a confirmed, working takeover demonstration.
Social engineering attacks (e.g., phishing) against Evident personnel or customers.
Denial of service (DoS/DDoS), resource exhaustion, or brute-force attacks.
Spam, bulk messaging, or abuse of public contact forms.
Non-security bugs (please report these to support@evident.security).
Issues in third-party services or applications that Evident integrates with — please report these directly to the applicable vendor.
Vulnerabilities requiring physical access to a user's device.

If you're uncertain whether a finding is in scope, include a clear description of the real-world impact along with a reproducible proof-of-concept, and we'll make a determination. Reports that don't include a proof-of-concept are unlikely to receive a substantive response.

Recognition

We appreciate the efforts of security researchers who help keep Evident secure. While we do not offer a paid bug bounty program at this time, we are happy to publicly acknowledge researchers who responsibly disclose valid vulnerabilities (with their permission).

Contact

For security-related reports, please contact us at security@evident.security. For automated discovery of our disclosure contact, Evident publishes a security.txt file in accordance with RFC 9116.

What to Expect

Acknowledgment: You will receive an automated acknowledgment upon receipt of your report.

Response: We will provide a substantive response within 3 business days, including our assessment and expected timeline for remediation.

Updates: We will keep you informed of our progress toward resolving the issue.

Safe Harbor

To qualify for safe harbor, researchers must:

Avoid actions that could harm Evident, our users, or our services

Not access, modify, or delete data belonging to other users

Stop testing and report the issue immediately upon discovering a vulnerability that exposes user data

Not disclose the vulnerability publicly until we have had a reasonable opportunity to address it

Out of Scope

Best-practice, hardening, or "posture" recommendations without a demonstrated exploit — including missing or weak security headers, TLS/SSL cipher suite suggestions, SPF / DKIM / DMARC adjustments, HSTS preload status, CSP tightening, cookie flag suggestions, and similar configuration tweaks.

Automated scanner output submitted without manual validation and a concrete proof-of-concept demonstrating impact.

Theoretical or informational findings without a working exploit — including missing rate limits without demonstrated abuse, clickjacking on pages with no sensitive action, open redirects without downstream impact, and verbose error messages that don't leak sensitive data.

Self-XSS or any issue requiring the victim to paste attacker-controlled content into their own browser console, devtools, or URL bar.

Email enumeration, account existence disclosure, or other issues inherent to standard authentication flows without a further demonstrated exploit.

CSRF on endpoints that do not perform sensitive state-changing actions or that are already protected by SameSite cookies or framework-level tokens.

Subdomain takeover claims without a confirmed, working takeover demonstration.

Social engineering attacks (e.g., phishing) against Evident personnel or customers.

Denial of service (DoS/DDoS), resource exhaustion, or brute-force attacks.

Spam, bulk messaging, or abuse of public contact forms.

Non-security bugs (please report these to support@evident.security).

Issues in third-party services or applications that Evident integrates with — please report these directly to the applicable vendor.

Vulnerabilities requiring physical access to a user's device.