Skip to main content
Security

Responsible disclosure policy

Last updated
July 4, 2026

We take security seriously at Golden Analytics. If you've found a vulnerability in our product, we want to hear from you — and we're committed to working with you to resolve it quickly.

How to report

Send your findings to our security team. Please include a description of the issue, steps to reproduce it, and the potential impact. We'll acknowledge receipt within 72 hours.

✉️
Security contact
security@goldenanalytics.com

What we ask of you

  • Give us reasonable time to respond before disclosing publicly (we request at least 90 days)
  • Avoid accessing, modifying, or deleting data that isn't yours
  • Don't perform denial-of-service attacks or disrupt production systems
  • Don't use social engineering, phishing, or physical access attacks
  • Only test against accounts and data you own or have explicit permission to test

Scope

In scope
app.goldenanalytics.com
api.goldenanalytics.com
Authentication flows
Data access controls
API endpoints
Out of scope
Third-party infrastructure (Supabase, AWS, Vercel)
Denial-of-service attacks
Social engineering
Spam or phishing
goldenanalytics.com (marketing site)

Our commitments

72h
Initial acknowledgment
7d
Severity assessment and triage
90d
Target remediation for critical findings

Safe harbor

We consider security research conducted under this policy to be authorized. We will not pursue civil or criminal action against researchers who act in good faith, follow these guidelines, and make a genuine effort to avoid privacy violations, data destruction, and service disruption.

If legal action is initiated by a third party against a researcher who complied with this policy, we will make clear to the relevant parties that the research was conducted in accordance with our policy.

This policy does not apply to findings in third-party systems or infrastructure we do not operate.

Encryption

For encrypted communications, you can use our PGP public key. You can verify the key on OpenPGP Keys.

Key fingerprint:

5FD2 C07B 7C96 49B7 FA2C 4920 FB4E 75D2 2072 60EC

Public key:

-----BEGIN PGP PUBLIC KEY BLOCK-----

mQINBGpJbr0BEAC5J+inRv18kQh7MZth2nvAbbD7S47xp5hkFGHyzQja/7hISJul
e5M0vc5E7EFryGTuD/4le1VhljsScr02KThr/aa1QADU/lnJ1OHsD6wsJ1ysVAOD
EFT0U9/VlFFJHXpjjgaz2DCimYqwFCwflBVRYD5N422yPQ1c9Nxh7j4IHdkekwYQ
1dBPuZWVBaBSal+9qBA3eyboiPg8gNABIp7qx9RsTusqEWPZ8m5TPCZDsUiRh4c+
D0UR4jmI8Ys8ZPPjGzS6fIYdYTu6wQ1E+Gva8uKx/9XhApM9lPlWpbi0fwdbm0Do
JaJuI+G+cHekr2wYS7XNtVeGBh3Msp4foYsv8vPa69XTxRxf0B3XoQOyiThXfdRS
aarrOxWCtYIXApQ3bOHhf27kzdi/lnSgtwYHuAkBj234qXi3uEWqwv8WVu2ry9gy
20ysRa3yIe/sK84OmajepoU8jitDO5MvLJElJ/cH75PAkUBgMCLq+ACJHtEN7QNG
SJ0CKdry2qfNnJnGNKamzVxHhO1TyPEgBv9ZJIaor/QH3db6Z6KfQGUrw+ObUSfO
Dgi9KZ4aRfqHprGWrFR7Qbth3Rp2OSeQYohqgObzvIZCqB04QCM7Nu4JLs9+vBNR
6vzdRvVRgTE0OmBsMMheUxJNewHMw6qLXDisnu1Qp4oyzafKcrx/I7XWnwARAQAB
tDhHb2xkZW4gQW5hbHl0aWNzIFNlY3VyaXR5IDxzZWN1cml0eUBnb2xkZW5hbmFs
eXRpY3MuY29tPokCcwQTAQgAXRYhBF/SwHt8lkm3+ixJIPtOddIgcmDsBQJqSW69
GxSAAAAAAAQADm1hbnUyLDIuNSsxLjEyLDAsMwIbAwUJAeEzgAULCQgHAgIiAgYV
CgkICwIEFgIDAQIeBwIXgAAKCRD7TnXSIHJg7F2iD/9CgOF8k69PPcXbcZjKb43F
l+nD9/jIUUWSfwQJzoYmp7bAZseERhjr+0NIx7S4Ec+z49//jBdOJBbpmPpY6/or
Ye09hp5VSBTAlIhY1+KR4kRg5u35tnSbxTbT0bAgXxvUPAIJlRmDwfnoS/SQYPYB
gbVw4c/Pf/Q5+siuigsueS3ldF43sS14qHtfVjCDoA7wICgx5cQoC6HkOCcQErkR
+kqdxbGgPrS0Vde0BYhovdyHcAcw2fxUJ6pg7WgxCBcF/GY7wqYRVYPRinSXT9qH
b79FtJecfq+J0dmBt+D9Xk93SJ1Pg5jUDaM3gjYQyyOxfE+RtUblDmK/iX0H1/vr
yfggEBxHQYx5cpyXsyO+nEsOnYls6Q1OIZhM4aty5gtEHzAv51tHU+7mca5aktd3
/B2VWS7+34oBhOuyFiuVD1ArUWAMJXYJZFWU3RAJdaoLxX3qeWH0oeTeDdsC+/rD
cUOT+MQ4Qe06R1UM/j0bpNbO6JDjPZij+RngI96Ldd2QjthnE5HnDMKJekb+0JXw
Ik0vmbZeXEDoB1HRkG9nhxlq/4uK23mdZc8Ct5/y7DvDNJqfwCAyRQje+2BrXgle
ZiUt7la1FRelrWNHEBqbPOHeEYzTVN/NvzJwzrRRKP74BO5Uz1VNkhhkHSb+nZF9
fjaQH3Pp/9OCRvbXVqz8qrkCDQRqSW69ARAAmIRo7AP0u/xiTGqSHH3/tLOv9Ev5
aDzwIE6vNu3W54JCKWfk/p29YldKi0YRX+ANvMBwUiujhof5/8rELzF75HK5N+f9
i3W967/5PmBHqiMtU3xjCEJatWtLVUbfCYLTcTep7/E5hKAGrMQGnwOgmM7Tfuzk
0G4a1woggJ4OugL+UOyVoX62IrKb3fvmu+5J9XVuPRGFDMrKB9MfSFcDu60VU9gN
F4fgeniZ9pKJrcelCM1FtNQUvtpUPXT9DBP7bqxfMmJLr3O+B1C0AlSnIkpUXlrO
2iHeHBdVUSPlZEyvZyq+nY1Nag9vkGeCd8Iq2ywcm4aojHWm6Asr0I8l7Zc3K1D8
7dMR7IVwN6pQRJJdjNQDqrmO3GtZl1XkYCjj6rtyyBpo++EXyPpRg1NNuB9SYOhN
ptO7jr7uFw2vCPcMSsMswsxnmOGDDgUTArRvbplPLmbsMy1wLNnO+0ZydMsGXfkV
uYjylNcOUaBVb32q/eAcPubLZt1DHW8emO/FPTpyEmnu3/mkSiX0vi/1TcDyFrsJ
wZuQMkIJTOHvH1LxEsMQO2c5SqY7QITw4QNI8vh+Me7UHIun+PlnUfsFZg2VnmTA
L8+MDstMITlgRus7LikTQkV3hF1m9vj5DHojt+mI56A5Rn1FZ5BPQCMS2JryLe3p
hwD+55W+NxZgHK0AEQEAAYkCWAQYAQgAQhYhBF/SwHt8lkm3+ixJIPtOddIgcmDs
BQJqSW69GxSAAAAAAAQADm1hbnUyLDIuNSsxLjEyLDAsMwIbDAUJAeEzgAAKCRD7
TnXSIHJg7F+uD/9kG/af5Yzav+a5icI0xXU8Zs7yWTHnKlkAZsSbVeVv2Ku5g8jw
DAdW8dc5KCFo4n6fjzWttBznGyAxDYBkeoUbvxMg3nM7I5/DWkyoA5LWpmS+kgG7
FtapAa8e6f0iGAc6AOjZ2k4CGqGveJHw9xy2r90bFonn6tJSKWQa6zU+mFCCN2KH
Pv+/zbUcHyhOqRI50liCGx9bfVXC4y2DXa628fWLdZE1vQ9A+SAC+0ZnlakK8rjd
uawErCbgtfKbFPy9dEuvWgbFQUzjAGOdWQlFC4jwBm8b6qJeVEbs+tLNIBPhQc9Z
PWzux9ZvMXoSK3CwIm0yIvOB2KAEReJs6PueRj7F++uOITMGPniQteJ/+VNoYUjy
v1MCcMBmRaL59sX4tTlNj887tvCoe7ves7msv3fCGbrtpuj5FkVAEs5L2sLLvTMB
lAyGUrXalEmEYUufF93udIbgA4GDWJizcqoCw4SuPO9YRIKTW6yu+4GKdtbHk9fG
YxVdPAc2gJ0rlKD2/dSdM8I2yNDivX6OB0eJxgG2U7Unetp1t/lYmBSgctqVj4SH
IEQG/npZSdyiJOdPbXcHvbPcdvxF2traL01rcYGVGih10WKOMpQSeJM3K+ZAPMdP
ElPHwwSqz6+/NUPVPMgRKYKElcjNl9vnavRqccbhabmXpe3NzHf4j4N/5A==
=Uvgv
-----END PGP PUBLIC KEY BLOCK-----