FlockConnect
ENESTry free

Vulnerability disclosure policy

Last updated: October 20, 2026

If you think you've found a security problem in FlockConnect, we want to hear about it. This page explains where to send it, what testing is allowed, what we promise in return, and how we protect you when you follow it.

FlockConnect holds churches' records about their people: names, contact details, groups, and the care their pastors give. Most of the rules below exist to keep real people's information out of anyone's testing.

How to report

Email security@flockconnect.com. It is our Official Channel for security reports. Please include:

  • what you found and where (the page, address or feature);
  • the steps to reproduce it in your own test church;
  • what someone could do with it;
  • how we can reach you, and the name you'd like us to use.

You can write in English or Spanish. We reply in the language you wrote in, with the English text underneath, and the English is the version that counts.

If you're not sure whether something is allowed, ask us at security@flockconnect.com before you go further.

What we promise

  • A receipt as soon as your report arrives. It's sent automatically.
  • A reply from a person within 3 business days.
  • A first assessment within 10 business days: whether we can reproduce the problem, whether it's in scope, and how serious we think it is.
  • An update at least every 14 days until we close your report.
  • A message when the fix has shipped.

A business day is Monday to Friday in US Eastern time, not counting US federal holidays. The day your report arrives isn't counted.

Where you may test

Test only in a church you sign up yourself. Every new church starts with a free 14-day trial, and no payment card is needed. Fill it with made-up people.

  • To test whether one church can reach another church's data, sign up two churches of your own and test between them. Never test against a church you didn't create.
  • If you need more time, ask, and we'll extend your test church's trial.
  • If you're on a church's staff or you volunteer at one, test in a separate trial church, never in your church's live workspace, even if your church says yes. A church can't consent for the people in its records.
  • If you notice something while using a real church normally, without testing for it, please report it. That is welcome, and it's covered by safe harbor too.

If you see someone else's data

Stop as soon as you see data that belongs to a real church or a real person. Look only as far as you need to know it's real, such as a name or an ID, and never open notes. Don't download, copy or share it, and blur it in any screenshot you send us. Report it right away, and once we confirm we have your report, delete anything you still have.

That church owns its data, so we'll tell them what happened. We won't give them your name unless you agree or the law requires it. An accident handled this way stays covered by safe harbor.

What not to do

  • No denial-of-service or load testing.
  • No social engineering or phishing of our team, of churches or of their members.
  • No physical testing of any kind.
  • No attacks on accounts that aren't yours.
  • Leave nothing behind: no backdoors, and no changes that last after your test.
  • Use only made-up people, and send email or texts only to addresses and phone numbers you own. Invitations, confirmations and care-team emails go to real inboxes.
  • Never submit a real church's public form or booking page. Each submission lands in that church's records and can send real email.

Automated scanners are allowed at no more than 5 requests per second. Put security-research and an email address where we can reach you in the User-Agent of every request, and never let a scanner fill in or submit a form.

What's in scope

  • Everything at flockconnect.com, and the same service at flockconnect-v2.vercel.app: the website, the app, the API under /api, the member portal, public forms (/forms), booking pages (/book), sign-in, and the emails and secure links we send.
  • The sign-in page of our founder console, at internal.flockconnect.net.
  • Our own setup of the outside services we use, such as a storage bucket or a database rule we configured wrong.

The outside services themselves belong to their providers: Supabase, Vercel, Stripe, Resend, Twilio, Planning Center, Google and Microsoft. Please report problems in their platforms to them. Anything this page doesn't list is out of scope.

Findings we don't treat as security reports

  • Missing security headers, when there's no working attack.
  • Email settings such as SPF, DKIM and DMARC.
  • Clickjacking on a page with no action worth tricking someone into.
  • Self-XSS: code that only runs against your own browser.
  • Cross-site request forgery on sign-out.
  • Missing rate limits, except on sign-in, sign-up and password reset.
  • Software version numbers that a page or header shows.
  • TLS cipher preferences.
  • Whether an address has an account, as answered by our sign-in provider's own service.

Two kinds of finding are always in scope, even when they look like something on that list:

  • Anything that reveals whether a person belongs to a church, even just whether an email address has an account with us. Church membership says something about a person's faith, so we treat it as sensitive. This covers everything FlockConnect runs; the only exception is our sign-in provider's own service, listed above.
  • Collie crossing a line. Collie is FlockConnect's AI assistant. Tell us if it shows someone data they aren't allowed to see, reaches into another church, sends data to an AI provider it shouldn't, or acts without a person approving. If Collie just says something odd or wrong, that's product feedback: please send it to support@flockconnect.com.

Safe harbor

(disclose.io's Safe Harbor, verbatim — CC0, dioterms terms/safe-harbor/en-US.md @ 0a19d515)

When conducting vulnerability research, according to this policy, we consider this research conducted under this policy to be:

  • Authorized concerning any applicable anti-hacking laws, and we will not initiate or support legal action against you for accidental, good-faith violations of this policy;
  • Authorized concerning any relevant anti-circumvention laws, and we will not bring a claim against you for circumvention of technology controls;
  • Exempt from restrictions in our Terms of Service (TOS) and/or Acceptable Usage Policy (AUP) that would interfere with conducting security research, and we waive those restrictions on a limited basis; and
  • Lawful, helpful to the overall security of the Internet, and conducted in good faith.

You are expected, as always, to comply with all applicable laws. If legal action is initiated by a third party against you and you have complied with this policy, we will take steps to make it known that your actions were conducted in compliance with this policy.

If at any time you have concerns or are uncertain whether your security research is consistent with this policy, please submit a report through one of our Official Channels before going any further.

Note that the Safe Harbor applies only to legal claims under the control of the organization participating in this policy, and that the policy does not bind independent third parties.

How this works at FlockConnect:

  • The waiver of our Terms covers testing in churches you signed up yourself.
  • It covers another church's data only when you came across it by accident and handled it the way this policy asks.
  • We may still pause a test church that is harming the service. A pause is not a claim against you, and we'll tell you why.

Telling others about what you found

Please keep the details private until the fix has shipped or 90 days have passed since your report, whichever comes first. If a fix needs longer, we'll ask you for more time and explain why. The decision is yours.

After that, you're free to publish. We'd like to see your write-up 5 business days before it goes out, but you don't need our approval. Never publish any real person's data.

We don't publish an advisory for each finding. FlockConnect runs as one hosted service, so churches have nothing to install or update. If a church needs to act, or its data was exposed, we tell that church directly.

Thanks, not payment

We don't pay for security reports, and we don't give gifts, swag, certificates or reference letters.

If your report is confirmed, falls within this policy's scope, follows this policy, and is the first to tell us about the issue, we'll offer to thank you by name on our thanks page once the fix has shipped. You choose the name we use and whether we link to you, or you can ask us to leave you off.

Questions

Write to security@flockconnect.com.