Responsible Disclosure

Last updated: 26 September 2026

Dash2Grow Inc. welcomes reports of security vulnerabilities in our website and our product.

Safe harbour

Dash2Grow Inc. authorises good-faith security research conducted in accordance with this policy.

If you make a good-faith effort to follow this policy, we will treat your research as authorised, we will work with you to understand and resolve the issue, and we will not initiate or support legal action against you, and will not refer you to law enforcement, for that research. This includes activity that would otherwise fall under anti-computer-misuse laws such as the United States Computer Fraud and Abuse Act, section 342.1 of Canada’s Criminal Code, or the United Kingdom Computer Misuse Act.

We will not treat good-faith research conducted under this policy as a breach of our Terms of Service or our acceptable use rules. To the limited extent necessary to allow that research, we waive any provision of those terms that would prohibit it, and where they conflict with this policy, this policy controls.

You remain responsible for complying with the laws that apply to you, including those of your own jurisdiction. This safe harbour is a commitment from Dash2Grow Inc. only. It does not bind any third party, and it does not authorise you to access data that is not yours or to breach any other law. Because laws differ across jurisdictions we cannot pre-authorise every activity everywhere — if in doubt, ask us before you act, and we will work with you in good faith.

How to report

Email legal@dash2grow.com with the subject line Security. Please include:

what you found, and where;
enough detail for us to reproduce it;
how we can reach you for follow-up;
other people’s personal data redacted, and the minimum needed to show the problem.

If you need to send a working exploit, ask us for an encrypted channel and we will arrange one.

What we ask

Give us 90 days from your report, or until a fix is released, whichever comes first, before disclosing publicly. We will coordinate the timing of any public disclosure with you, and we ask you to use the address above rather than a public forum until then.
Test only against your own account, or an account you have explicit permission to test.
Stop and tell us as soon as you find a vulnerability. Do not go further than is needed to demonstrate it, and never access, modify or delete data that is not yours. If you come across data that is not yours, stop — do not download, keep or share it.
Do not degrade or disrupt our services.
Do not demand payment in exchange for withholding a vulnerability. We do not respond to threats.
Act in good faith, and stay within the law.

What we will do

We read every report we receive.

We keep your report and your identity confidential. We will not share information that identifies you outside Dash2Grow Inc. without your permission, unless the law requires it.

We handle any personal data in a report in line with our Privacy Notice, and delete it once it is no longer needed to fix and verify the issue.

We do not currently operate a paid bug bounty programme.

Scope

This policy covers the website at dash2grow.com and the parts of our product reached from it.

It does not cover:

⛔ any other host or domain, including development, staging, preview and test environments, and any host operated on someone else’s domain. If it is not dash2grow.com, this policy does not authorise you to test it — please ask us first;
services operated by third parties, even where we use them;
denial-of-service, volumetric or load testing;
social engineering, and physical attacks;
findings that require a compromised device, a rooted or jailbroken environment, or a person already logged into their own account (self-XSS);
reports of missing hardening with no demonstrated impact.

Changes

We may update this policy, and will update the date at the top of this page when we do.

Dash2Grow Inc. · 7 Bayview Station Rd, Ottawa, ON K1Y 2C5, Canada · legal@dash2grow.com

Nothing on this page is legal advice.