Vulnerability disclosure policy

1. How to report

Email security@hollyhr.com. Please include:

• what is affected: the web address, API endpoint or MCP tool;
• what the problem is and what an attacker could do with it;
• the steps to reproduce it, with requests, screenshots or a short video;
• whether you saw any data that is not yours;
• whether, and how, you would like to be credited.

We read reports in English. We do not publish an encryption key. If you need to send something sensitive, say so in a first email and we will agree a safe way to receive it. For help with an account, email support@hollyhr.com instead.

2. What is in scope

• HollyHR's own websites under hollyhr.com, including www.hollyhr.com, app.hollyhr.com, workspace addresses, developers.hollyhr.com and ops.hollyhr.com.
• The HollyHR API, signed webhooks and the hosted MCP server.
• HollyHR's open-source projects at github.com/hollyhr.

These are out of scope:

• Services run by our providers, such as AWS, Vercel, Neon or Stripe. Report those to the provider. If the problem is how HollyHR has set a provider up, it is in scope. The sub-processor register lists every provider.
• Social engineering or phishing of HollyHR staff or customers.
• Denial of service, load testing or spam.
• Physical attacks on people, offices or equipment.
• Findings from automated scanners with no demonstrated impact, such as a missing header on its own.

3. What we ask of you

• Test only with accounts and workspaces you own. You can create a free workspace at app.hollyhr.com/signup.
• If you reach data that is not yours, stop. Access no more than you need to show the problem, do not keep or share it, and tell us straight away.
• Do not change or delete data that is not yours.
• Do not disrupt the service: no denial of service, brute force or high-volume automated scanning.
• Do not install malware or keep any access after testing.
• Keep the problem confidential until we have fixed it, or until 90 days after your report, whichever comes first. Tell us before you publish.
• Do not ask for payment in return for the details.
• Follow the law, including UK data protection law.

4. What we promise

• We will acknowledge your report within 2 UK business days.
• We will tell you whether we can reproduce the problem, what we plan to do, and keep you updated until it is resolved.
• If your research follows this policy in good faith, we will not take legal action against you or report you to the police. We treat it as authorised under our Acceptable Use Policy.
• We will credit you by name or handle when we describe the fix, if you want.

We do not run a paid bug bounty and do not pay for reports. If a problem affected customer data, we will tell the customers affected as our Data Processing Agreement requires.

5. About this policy

This policy follows the National Cyber Security Centre's vulnerability disclosure toolkit and the GOV.UK vulnerability reporting policy. Every HollyHR website publishes the same contact in /.well-known/security.txt. Read more about how HollyHR protects data on the Security page.