# Vulnerability Disclosure Policy

MagicSchool welcomes responsible security research. This policy describes how to report potential vulnerabilities and what to expect.

## ⚠️ Important: This Is Not a Paid Bug Bounty Program

MagicSchool does not offer monetary compensation for vulnerability reports. We appreciate the security community's efforts, but we cannot pay for unsolicited submissions. By submitting a report, you acknowledge this policy.

## Scope

**In Scope:**
- magicschool.ai and its subdomains
- MagicSchool mobile or non-browser based applications
- Vulnerabilities that demonstrate actual, exploitable security impact

**Explicitly Out of Scope (reports will not be reviewed):**
- Missing security headers without demonstrated exploit
- SSL/TLS configuration issues (we monitor these internally)
- Version disclosure or banner information  
- Clickjacking on pages without sensitive actions
- CSRF on logout or unauthenticated forms
- Rate limiting issues without demonstrated impact
- Denial of Service (DoS/DDoS) - do not test this
- Social engineering, phishing, or physical attacks
- Third-party services or applications we don't control
- Automated scanner output without manual verification
- Reports demanding payment or threatening disclosure

## Requirements for Valid Submissions

To be considered, your report MUST include:

1. **Subject line tag: [MSAI-VDP]** - Emails without this tag will be auto-filtered
2. **Proof of exploitability** - Not just theoretical risk, but demonstrated impact
3. **Step-by-step reproduction** - We must be able to verify the issue
4. **Single submission** - Duplicate or bulk automated reports will be ignored
5. **Good faith** - No accessing user data, disrupting services, or public disclosure

## What We Commit To

- Acknowledging receipt within 5 business days
- Investigating reports that meet our criteria in good faith
- Not pursuing legal action against researchers who follow this policy
- Crediting researchers (if desired) when we fix valid issues

## What We Do NOT Commit To

- Monetary compensation of any kind
- Response to reports that don't meet the above criteria
- Engagement with threatening or coercive communications
- Timeline guarantees for fixes

## How to Submit

Email: security@magicschool.ai

Subject line MUST include: [MSAI-VDP]

Include in the body: Asset affected, vulnerability type, step-by-step reproduction instructions, and impact assessment.

Reports without the required subject line tag may be automatically filtered and will not receive a response.

---

*Reports that demand payment, threaten disclosure, or fail to meet the above requirements will not receive a response.*