We take security seriously at Sensible Analytics. If you discover a security vulnerability, please report it responsibly.

Email: security@sensibleanalytics.co

Please include:

• Description of the vulnerability
• Steps to reproduce
• Potential impact assessment
• Suggested fix (if available)

1. Acknowledgment within 48 hours
2. Initial assessment within 5 business days
3. Regular updates on remediation progress
4. Credit in release notes (if desired)

This policy covers all repositories under the Sensible-Analytics organization:

• PropRoo - Property analytics engine
• CrewCircle - Workforce management
• Folio - Portfolio tracking
• CardScannerApp - Mobile card scanning
• Video Analysis - Video processing pipeline
• Qullamaggie Scanner - Stock scanner
• Rental-app - Property management
• Rentroo - Landlord tools

All repositories employ:

• Dependabot for automated dependency updates
• Code Scanning via GitHub CodeQL
• Secret Scanning to detect exposed credentials
• Branch Protection on main/master branches

We support safe harbor for security researchers who:

• Follow responsible disclosure practices
• Avoid accessing user data beyond what's necessary to demonstrate the vulnerability
• Make good faith efforts to avoid disruption

We will not pursue legal action against researchers who comply with this policy.