# Superposition vulnerability disclosure
#
# Please report suspected security vulnerabilities in Superposition-owned systems to
# security@superposition.ai. If your report contains sensitive details, encrypt it
# with the public key linked below.
#
# In scope:
# - Public web properties: superposition.ai and docs.superposition.ai
# - Application surfaces: app.superposition.ai, Superposition dashboard, backend/API endpoints, authentication, database-backed workflows, and email service
# - Recruiting workflows: role/job setup, candidate search, candidate profiles, contact history, pipeline stages, interview summaries, outreach drafts, sent outreach, reply classification, and interview scheduling
# - Customer/candidate data: job descriptions, candidate personal data, candidate contact details, email/calendar-derived recruiting context, pipeline metrics, client health, agreements, and billing status
# - Integrations and connected apps: Google Workspace/Gmail/Calendar connections, OAuth/authorized app flows, MCP server/client connections, preset URLs, revocation/scoping behavior, webhooks, and customer-configured custom endpoints
# - Infrastructure or configuration issues that could expose or modify Superposition-controlled data, secrets, tokens, credentials, logs, backups, or production configuration
#
# Vulnerabilities we want to hear about include:
# - Broken access control, privilege escalation, or cross-customer account/workspace isolation bypasses
# - Unauthorized access to customer, candidate, company, billing, email, calendar, or recruiting data
# - Authentication/session issues, including login bypasses, account takeover paths, insecure session handling, token leakage, or authorization-code/token reuse
# - Integration security issues, including OAuth consent/scoping bypasses, MCP preset leakage, webhook forgery/replay, missing revocation, or connected-app access beyond the configured permissions
# - Injection vulnerabilities, including SQL/NoSQL/command/template injection or stored cross-site scripting with real impact
# - Server-side request forgery, insecure direct object references, path traversal, unsafe file handling, or unsafe customer-configured endpoint access
# - Sensitive data exposure in APIs, logs, client bundles, error messages, backups, analytics, public assets, or status/debug surfaces
# - Misconfigured cloud storage, exposed secrets, leaked credentials, or CI/deployment configuration that affects Superposition systems
# - Email, outreach, scheduling, or reply-classification flaws that could send unauthorized messages, expose threads, alter candidate state, or access unrelated Gmail/Calendar data
#
# Out of scope:
# - Denial-of-service, stress testing, or high-volume automated scanning
# - Social engineering, phishing, spam, or physical attacks
# - Third-party/vendor systems unless the issue exposes Superposition-controlled data or configuration
# - Low-impact missing-header/configuration reports without a practical exploit path
# - Accessing, modifying, deleting, or exfiltrating data that does not belong to you
#
# Please include:
# - Affected URL, endpoint, product area, or account context
# - Clear reproduction steps or proof of concept
# - Security impact and any conditions required to reproduce it
# - Logs, screenshots, or request IDs that help us investigate
#
# We do not currently operate a public bug bounty program or guarantee compensation.

Contact: mailto:security@superposition.ai
Encryption: https://superposition.ai/.well-known/security.asc
Preferred-Languages: en
Canonical: https://superposition.ai/.well-known/security.txt
Expires: 2027-07-08T18:13:24Z