Incident Response / Security Reporting (Responsible Disclosure)
How QuoteFinder.ca handles security issue reports, responsible disclosure, and incident response (plain-English overview)
1. Purpose of this page
This page explains how QuoteFinder.ca (“QuoteFinder.ca”, “we”, “us”, or “our”) handles:
- security vulnerability reports from researchers, users, providers, and the public;
- responsible (coordinated) disclosure of security issues; and
- our general incident response approach when we become aware of a potential security incident.
Our goal is to support good-faith reporting, reduce harm, and improve platform security while protecting users and platform operations.
Good-faith reporting is welcome
If you believe you found a security issue, please report it to us as soon as possible and avoid actions that could expose data, disrupt service, or impact other users.
2. How to report a security issue
To report a suspected vulnerability, security weakness, or suspicious platform behavior, contact us through our support/contact page and clearly label the message as a security report:
- Contact / Support (include “Security Report” in the subject or first line)
If the issue appears urgent (for example, active exploitation, exposed sensitive data, or account compromise risk), please say so clearly in the first line of your report.
3. What to include in a security report
Reports are much easier to review when they include enough detail for our team to reproduce and assess the issue.
Please include, where possible:
- the page URL, feature, or workflow affected;
- a clear description of the issue and why it may be a security risk;
- steps to reproduce the issue (or the exact sequence of actions you took);
- what happened vs. what you expected to happen;
- screenshots, logs, or short proof-of-concept details (without exposing sensitive data publicly);
- date/time observed and your browser/device info (if relevant);
- your contact information so we can follow up if clarification is needed.
Please do not send passwords, full payment card numbers, or unnecessary personal information in your report.
4. Responsible disclosure expectations (what we ask reporters to do)
If you report a security issue to QuoteFinder.ca, we ask that you act in good faith and follow responsible disclosure practices.
In particular, please:
- stop testing once you have enough information to demonstrate the issue;
- avoid viewing, downloading, copying, or sharing data that is not your own;
- avoid changing, deleting, or creating data in another user’s account;
- avoid actions that could interrupt service or degrade platform performance;
- keep details of the issue private until QuoteFinder.ca has had a reasonable chance to investigate and address it;
- share findings directly with QuoteFinder.ca instead of posting public exploit details first.
Do not test in ways that harm users or the platform
Even if your intent is to help, actions that expose other users’ data, cause downtime, or interfere with platform operations are not permitted.
5. Prohibited testing and out-of-bounds activity
The following activities are not authorized under this page and may violate our policies or applicable law:
- social engineering, phishing, or impersonation targeting QuoteFinder.ca users, staff, providers, or partners;
- credential stuffing, brute force attacks, password guessing, or account takeover attempts;
- denial-of-service (DoS), traffic flooding, or stress testing without written authorization;
- malware deployment, malicious payloads, or attempts to plant persistent code;
- scraping, bulk data extraction, or mass enumeration of user/provider data;
- accessing admin areas, private endpoints, or data you are not authorized to access;
- exploiting a vulnerability to view, copy, alter, or delete third-party data;
- testing against third-party services or vendors used by QuoteFinder.ca without their permission;
- extortion, threats, ransom demands, or disclosure demands tied to payment.
6. Scope of reports we can review
QuoteFinder.ca can review reports related to QuoteFinder.ca-controlled websites, dashboards, forms, platform workflows, and related features.
Some issues may be outside our direct control, including (for example):
- vulnerabilities in third-party websites or services not controlled by QuoteFinder.ca;
- issues caused solely by local device malware or browser extensions;
- reports that are purely spam, phishing simulations, or social engineering attempts;
- general configuration advice without a reproducible security issue;
- low-risk issues that do not create a meaningful security impact.
We may still appreciate the report, but we may not be able to act directly in all cases.
7. What happens after you submit a report
When we receive a security report, QuoteFinder.ca may:
- acknowledge receipt (where possible and where contact details are provided);
- triage the report and assess potential severity and impact;
- request clarification or additional reproduction steps;
- investigate the issue internally and/or with relevant service providers;
- prioritize remediation based on risk, exploitability, and user impact;
- monitor for related abuse or indicators of exploitation;
- take temporary mitigations while a permanent fix is developed.
Response and remediation timing can vary based on severity, complexity, and whether third-party vendors are involved.
Severity-based prioritization
Issues that may expose sensitive data, enable unauthorized access, or create active exploitation risk are generally prioritized ahead of lower-risk findings.
8. Incident response (plain-English overview)
If QuoteFinder.ca becomes aware of a potential security incident, we may activate internal incident response procedures appropriate to the situation.
Depending on the incident, our response may include steps such as:
- detecting and confirming suspicious activity or system impact;
- containing the issue (for example, restricting access, disabling features, or applying temporary controls);
- investigating what happened and what systems/data may be affected;
- remediating vulnerabilities or misconfigurations;
- restoring services safely and monitoring for recurrence;
- documenting the incident and improving controls/processes after review.
Where required by applicable law, QuoteFinder.ca may provide notifications to affected individuals, regulators, or other parties.
9. Coordinated disclosure and public disclosure timing
QuoteFinder.ca supports coordinated disclosure in principle. We ask reporters to avoid public disclosure of vulnerability details until we have had a reasonable opportunity to investigate and address the issue (or mitigate the risk).
If you plan to publish findings, please coordinate with us first through the reporting channel so we can assess user risk and timing.
QuoteFinder.ca may choose not to disclose certain technical details publicly where doing so would create unnecessary risk.
10. Safe-harbor style statement (limited, conditional)
QuoteFinder.ca will generally not pursue claims against individuals for good-faith security research that:
- is performed solely to identify and report a security issue to QuoteFinder.ca;
- follows this page and our platform rules;
- avoids harm, data access, disruption, and privacy violations;
- does not involve fraud, extortion, or abuse.
This statement is limited and conditional. It does not authorize unlawful conduct, access to third-party systems, privacy violations, scraping, social engineering, denial-of-service testing, or exploitation that harms users or the Platform.
This statement also does not bind third parties (such as hosting providers, payment providers, or regulators).
No authorization for invasive testing
If your testing goes beyond good-faith reporting (for example, exfiltrating data, causing disruption, or targeting other users), this page does not protect or authorize that conduct.
11. Bug bounty / compensation
QuoteFinder.ca may review and appreciate security reports, but unless QuoteFinder.ca expressly announces a bug bounty or rewards program in writing, there is no guaranteed payment, reward, or compensation for submitting a report.
Do not condition disclosure on payment or other demands.
12. Privacy and handling of security reports
Information submitted in a security report may be used by QuoteFinder.ca for triage, investigation, remediation, trust & safety review, legal/compliance assessment, and incident response.
We may share report details internally with authorized personnel and with relevant service providers where needed to investigate or fix an issue.
For broader information about data handling practices, please see our Privacy Policy.
13. False reports, abusive reports, and misuse of this process
QuoteFinder.ca may restrict or ignore reports that are abusive, deceptive, spammy, extortionate, or clearly not submitted in good faith.
Misuse of the reporting process may itself result in enforcement action under our platform policies, including the Acceptable Use Policy (AUP).
14. Relationship to other policies
This page should be read together with our Acceptable Use Policy (AUP), Security & Data Retention Overview, Privacy Policy, and Trust & Safety Enforcement / Policy Violations.
Where other platform rules apply (for example, anti-spam, account suspension, or identity verification), those rules continue to apply in addition to this page.
15. Changes to this page
We may update this Incident Response / Security Reporting (Responsible Disclosure) page from time to time to reflect changes in platform features, security practices, or operational needs.
When this page is updated, we will post the revised version and update the “Last updated” date below.
16. Contact for security reporting
To report a suspected security issue or responsible disclosure finding, contact us through:
- Contact / Support (include “Security Report” in the subject or first line)
Please include enough detail so we can triage and investigate the report efficiently.
17. Related pages
- Security & Data Retention Overview
- Privacy Policy
- Acceptable Use Policy (AUP)
- Account Suspension / Appeals Policy
- Trust & Safety Enforcement / Policy Violations
- Contact / Support
Last updated: February 23, 2026
