Responsible disclosure policy.

Our commitments to you

• Acknowledge your report within 2 business days.
• Validate and triage within 5 business days, with a preliminary severity assessment.
• Keep you informed as we remediate, including a target timeline once we understand scope.
• Credit you publicly (with your permission) once the issue is resolved.
• Treat your report as confidential. We never share reporter details with third parties.

What's in scope

• • lifesavertech.ca and its subdomains we operate
• • Software, AI agents, and platforms we have built and continue to host or manage for customers
• • Public APIs published by us (e.g. our website's /api endpoints)

Out of scope

• • Third-party services we use but don't operate (Vercel, Anthropic, OpenAI, VAPI, Google, Stripe, Twilio, Resend, Supabase, etc.), please report those directly to the vendor
• • Software handed off to clients that we no longer host or maintain
• • Social-engineering, phishing, or physical attacks against our team or clients
• • Findings from automated scanners with no demonstrated impact
• • Missing best-practice headers on pages where the impact is purely theoretical

Bug bounty

We don't currently run a paid bug bounty program. We do acknowledge valid reports publicly (with your permission) and recognize researchers in our hall of fame as we receive valid disclosures.

Safe harbor

Lifesaver Technology Services Inc. will not pursue legal action against you for security research conducted in good faith and in accordance with this policy. If a third party initiates legal action against you for activities that are consistent with this policy, we will make this position known publicly.