Legal

Reporting

Send vulnerability reports to [YOUR CONTACT EMAIL]. Include affected URLs, API routes, packages, reproduction steps, impact, evidence, and whether any data that was not yours was accessed.

In Scope

• The public Bluebuild web application.
• Documented Bluebuild APIs.
• Authentication, authorization, project access, and integration handling.
• Public repository code maintained by Bluebuild.

Out of Scope

• Denial-of-service or load testing.
• Social engineering, phishing, or physical attacks.
• Attacks against third-party providers or suppliers.
• Accessing, modifying, deleting, or exfiltrating data that is not yours.
• Automated scanning that degrades the Service.

Safe Harbor

If you act in good faith, follow this policy, avoid privacy violations and disruption, and report issues promptly, Bluebuild will not pursue legal action against you for the research itself.