Report it, and we will act on it.

Email billing.labs@sfgoc.org with “Security report” in the subject line, or use the SFGOC contact page and mark it as a security concern for SFGOC Labs.

Please include, as far as you can:

• The product and the URL or interface where you found the issue.
• What the issue allows someone to do, in one or two sentences.
• The steps to reproduce it, in order.
• Anything that helps us confirm it: a request, a response, a screenshot.

We will confirm we received your report and tell you what we find. We do not run a paid bounty programme, and we will not claim to have one that does not exist.

• Report privately first and give us a reasonable chance to fix the issue before disclosing it.
• Use only accounts and data you own. Do not access, modify or retain anyone else's information.
• Do not run denial-of-service tests, spam, social engineering, or physical intrusion attempts.
• Stop as soon as you have confirmed a problem exists — proving it once is enough.

Reports made in good faith under these terms are welcome, and we will not pursue action against someone who follows them.

• Least data: collect what a feature genuinely needs, and no more.
• Access separation: keep tenants, households and accounts isolated by design, not by convention.
• Secrets stay server-side, and credentials are never embedded in client code.
• Dependencies are kept current, and security-relevant updates are prioritised over feature work.
• Security-relevant changes are reviewed before they ship, and failures are treated as design problems rather than user error.

SFGOC Labs holds no security certification, has not published an independent audit, and claims no compliance attestation. Where a product page describes assurance or compliance capability — AssurIQ in particular — that describes what the product is designed to help its users do, and is not a statement about a certification held by SFGOC Labs.

Products in development change quickly. See product stages for what each stage does and does not imply.