1. Purpose

QuickCasa runs a platform that holds personal information belonging to people who are looking for somewhere to live. If there is a security flaw in it, we would rather hear about it from you than read about it later.

This policy is our commitment to the people who look. It sets out what you may test, how to tell us what you found, what we will do about it, and the assurance that reporting a flaw in good faith will not be met with a lawyer's letter.

It is a companion to the QuickCasa Information Security Policy, which defines how we triage, contain and communicate a security incident once one is confirmed.

2. Our Commitment

If you follow this policy, we will:

Acknowledge your report and tell you a real person has it.
Investigate properly and tell you what we found, including when we disagree with you.
Keep you updated while we work on it, rather than going silent.
Credit you when the issue is resolved, if you would like us to.
Not pursue or support legal action against you, as set out in Section 7.

We will not ask you to sign a non-disclosure agreement as a condition of us accepting or fixing your report.

3. Scope

This policy covers software and services operated by QuickCasa, including:

The QuickCasa marketing website and the customer portal.
The QuickCasa API, the MCP server, and the developer and integration surfaces.
The website builder, its preview and publishing infrastructure, and the forms, media, asset and micro-site services.
QuickPass, the renter-facing product, and the resident portal.
The QuickCasa browser extension.
The QuickCasa Trust Center.

If you find something in a QuickCasa-operated service that is not in this list, report it anyway. The list describes what we run, not a boundary designed to catch you out.

4. Out of Scope

Systems we do not operate. Our infrastructure and vendor services, including our cloud provider, payment processor, communications providers and model providers, belong to those companies and are covered by their own disclosure programmes. Report to them directly. If the flaw is in how QuickCasa has configured one of those services, that is in scope and we want to hear about it.

Websites published by our customers on their own domains. The website builder publishes sites that customers own, on customers' domains, containing customers' content. Those sites are not ours to authorise testing on, and we cannot extend safe harbour over somebody else's property. If you believe you have found a flaw in the platform that publishes them, that is in scope, and you can demonstrate it against our own properties rather than against a customer's.

Other people's data. Nothing in this policy authorises you to access, retain or exfiltrate data belonging to a customer, a renter or any other person. See Section 6.

Social media accounts and third-party marketing platforms.

5. Findings We Are Unlikely to Act On

These are reported often and, on their own, do not describe a vulnerability. We will still read them, but expect a short answer unless you can show impact.

Missing security headers, cookie flags or TLS configuration preferences, with no demonstrated exploit.
SPF, DKIM or DMARC configuration, absent a working spoofing demonstration.
Self-XSS, or an attack requiring the victim to paste code into their own console.
Clickjacking on pages with no state-changing action.
Rate limiting on endpoints that do not authenticate, guess credentials or send messages.
Software version disclosure, banner grabbing, and directory listings containing nothing sensitive.
Output from an automated scanner submitted without a proof of concept.
Attacks requiring physical access, a rooted or jailbroken device, a compromised email account, or a network position the reporter controls.
Social engineering of our staff, our customers or their renters.
Denial of service, resource exhaustion and volumetric testing of any kind.

6. Rules of Engagement

Please:

Use your own accounts. Register a test account rather than testing against a real one. If you need something a self-serve account cannot reach, ask us and we will try to arrange it.
Stop at proof. Once you have demonstrated a flaw, stop. Do not enumerate further records to establish how bad it is. Tell us and we will establish that ourselves.
Leave data alone. Do not access, copy, modify, retain or delete data that is not yours. If you encounter personal information by accident, stop immediately, do not save it, and tell us what you saw so we can assess the exposure.
Do not pivot. Do not use a flaw to reach another customer's tenant, another renter's account, or our internal systems.
Do not degrade the service. No denial of service, no load testing, no automated scanning heavy enough to affect availability. People are trying to find housing on these systems.
Do not involve other people. No phishing, no social engineering, no physical intrusion.
Give us time. See Section 9 before publishing anything.
Follow the law. This policy does not authorise activity that is unlawful independently of our authorisation.

7. Safe Harbour

If you make a good-faith effort to comply with this policy during your research, we will consider your activity authorised.

We will not initiate or support legal or law enforcement action against you in relation to that research, including under the Criminal Code of Canada section 342.1, the United States Computer Fraud and Abuse Act, the Digital Millennium Copyright Act anti-circumvention provisions, or equivalent legislation elsewhere.
We will not ask you to take down or retract research that complies with this policy.
If a third party brings action against you for activity conducted in compliance with this policy, we will make it known, publicly if necessary, that your activity was authorised by us.
If you are uncertain whether something is in scope or permitted, ask before you test. We will answer, and asking will never be held against you.

This authorisation extends only to QuickCasa. We cannot authorise testing against systems belonging to our customers, our vendors or anyone else, and this section does not attempt to.

Good faith is assessed on what you did, not on how the finding turned out. Accidentally reaching further than you intended and telling us promptly is good faith. Continuing once you understood what you had reached is not.

8. How to Report

Email info@quickcasa.ai with "Security" in the subject line. Reports reach the CTO.

Please include:

What the issue is and which QuickCasa service it affects.
The steps to reproduce it, in enough detail that we can follow them.
What an attacker could do with it, in your assessment.
Any proof of concept, screenshots or logs. Redact any personal information you encountered before sending it to us.
How you would like to be credited, or that you would prefer not to be.

Write in whichever language you are most precise in. If you need to send the report encrypted, say so and we will arrange a channel before you send anything sensitive.

You may report anonymously. We would rather have the finding than the name.

9. What Happens Next

Stage	Our target
Acknowledgement	3 business days
Initial assessment, including whether we accept the finding and our severity view	10 business days
Progress updates while the issue is open	At least every 14 days
Fix for a critical issue	7 days
Fix for a high severity issue	30 days
Fix for a medium severity issue	90 days
Fix for a low severity issue	Best effort, and we will tell you if we decide not to fix it

Confirmed reports are handled under the incident response process in the Information Security Policy. Where a flaw exposed customer or renter data, the notification obligations in that policy apply and are not affected by how we learned of it.

We will tell you when the fix ships.

10. Publication

We support coordinated disclosure and we do not ask for indefinite silence.

Please give us 90 days from your report before publishing, or until the fix ships, whichever comes first.
If we need longer, we will explain why and agree a date with you rather than letting the clock run out quietly.
If we have gone silent on you, or we dispute a finding we cannot explain away, publishing after 90 days is a reasonable thing to do and we will not treat it as a breach of this policy.
Please do not include customer or renter data in anything you publish, including screenshots.

11. Recognition

QuickCasa does not currently operate a paid bug bounty. We are not going to imply otherwise.

What we do offer is a public acknowledgement, with your name or handle as you prefer, for any report that leads to a change. If you would rather stay anonymous, that is fine and it does not affect how we handle your report.

12. Compliance, Exceptions and Review

Compliance. The commitments in this policy, including the response targets in Section 9, are obligations on QuickCasa. Failure to meet them is recorded and reviewed.
Exceptions. Any decision not to fix a confirmed vulnerability must be recorded with its justification, an accepted-risk owner and a review date, and is raised at the quarterly risk review.
Review. This policy is reviewed and re-approved by the CTO at least annually, and sooner following a material change in the services in Section 3 or in applicable law.

Appendix A: Document History

Version	Date	Author	Summary
1.0	2026-09-08	CTO	Initial policy.

The following records support this policy and are maintained by the CTO:

Vulnerability report register, with received, acknowledged, triaged and resolved dates
Accepted-risk decisions for confirmed vulnerabilities not being fixed
Researcher acknowledgements
Incident records, where a report became an incident