Security & Vulnerability Disclosure

If you believe you have found a security vulnerability in Hilltelligence, we want to hear about it. Email kirk+hilltelligence@firstcontact.llc with enough detail to reproduce the issue — the affected URL or endpoint, the steps you took, and what you observed. A machine-readable version of this policy lives at /.well-known/security.txt.

• We will acknowledge your report within 2 business days.
• We will investigate promptly, keep you informed of our progress, and tell you when the issue is resolved.
• We will not pursue or support legal action against researchers who report vulnerabilities in good faith, make a reasonable effort to avoid privacy violations and service disruption, and give us a reasonable opportunity to remediate before any public disclosure.
• We are a small operation and do not currently offer a paid bug bounty.

In scope: the Hilltelligence application and its API (this site and its subdomains). Out of scope: denial-of-service testing, spam or social engineering of our users or staff, physical attacks, and vulnerabilities in third-party services we use (Clerk, Supabase, Vercel, Stripe, Anthropic, Resend) — report those to the vendor, though we appreciate a heads-up if a configuration of ours is implicated. Please do not access, modify, or delete data that is not your own; if a proof of concept requires demonstrating access to other users’ data, stop at the minimum demonstration and report.

Hilltelligence serves public legislative data alongside user work product. User-composed content and generated work product are encrypted at the application layer (AES-256-GCM) before reaching the database; every table carries row-level security; two-factor authentication is enforced for account access to analysis and AI features; mutating API routes are CSRF-guarded and validated, with rate limiting on abuse-prone endpoints; and the site ships an enforcing Content-Security-Policy. Security documentation prepared for institutional review is available to counterparties on request via the contact above.