Found a security issue? Here’s how to reach us.

Email security@newpublicservice.com with what you found. Please don’t open a public GitHub issue, and please don’t include real member personal information beyond the minimum needed to demonstrate the issue.

A useful report includes:

• —The affected surface or URL — the public site (www), the member portal (portal), or the backend API.
• —Steps to reproduce, and a proof-of-concept if you have one.
• —The impact you believe the issue has.

In scope: the production public site (www), member portal (portal), and backend HTTP API (backend), at their production domains.

Out of scope:

• —Third-party systems we depend on, which should be reported to those providers.
• —Denial-of-service, volumetric, or load testing.
• —Social engineering of our team or vendors, and physical attacks.
• —Findings that require privileged access we granted you.
• —Best-practice or hygiene observations with no demonstrable vulnerability.

We consider security research and disclosure conducted in good faith under this policy to be authorized, and we will not pursue or support legal action against a researcher who acts accordingly — who stays within scope, avoids privacy violations, data destruction, and service degradation, and gives us a reasonable opportunity to remediate before disclosing publicly.

If you are unsure whether a specific action is authorized, ask us first at the address above.

As a small team, we commit to what we can reliably keep:

• —We acknowledge your report within 5 business days.
• —We assess it and assign a severity within 10 business days of acknowledgement.
• —We communicate a remediation timeline based on that severity and keep you updated until the issue is resolved. We don’t commit to a fixed fix-by date; we do commit to keeping you informed.

In return, we ask that you:

• —Practice coordinated disclosure — give us a reasonable opportunity to remediate before disclosing publicly.
• —Stay within scope, and don’t access, modify, or delete data that isn’t yours — stop at the minimum needed to demonstrate the finding.
• —Do not degrade service — no denial-of-service or high-volume automated testing.