HirePitch policy
Security
External counsel review of these terms is a launch gate that is not yet complete. The commitments below describe how the product actually behaves today; wording may tighten after review, and no candidate fee or stored value may ever be introduced.
Report a vulnerability to security@hirepitch.app.
Disclosure
We acknowledge reports within two business days and aim to remediate critical issues within seven days. Please avoid accessing other people’s data, degrading service, or running automated scans against production. We will not pursue legal action for good-faith research that follows this policy. Machine-readable contact details are at /.well-known/security.txt.
Controls
- Deny-by-default Content Security Policy, HSTS, strict referrer policy, frame and MIME protections.
- CSRF tokens plus Origin checks on every cookie-authenticated mutation.
- Payment webhooks verified over exact raw bytes with a replay window; browser events never fulfill a payment.
- Separate keys for webhooks, quote signing and content encryption; encrypted-at-rest moderation evidence.
- Per-IP and per-account rate limits on sign-in, search, tool calls, applications, quotes, checkout and admin actions.
- Logs redact cookies, sign-in links, quote tokens, provider URLs and user-authored content.
Out of scope
Findings against third-party providers should go to those providers. Reports that require a victim to disable browser security features, or that describe missing headers with no exploitable consequence, are usually informational.