Protect data
Do not access, modify, delete, or exfiltrate data that does not belong to you. Use test accounts where possible.
Responsible disclosure
If you discover a security issue in COUNT services, we want to know. This page explains how to report it safely and what you can expect from us.
Scope
We welcome reports for the COUNT services listed below. Please do not test third-party services that COUNT does not operate.
- Marketing site:
https://www.getcount.com,count-clone-expanded.lovable.app - Application:
app.getcount.com - Developer platform:
developers.getcount.com
Out of scope: physical attacks, social engineering, denial-of-service against production environments, and third-party services not operated by COUNT.
Rules of engagement
We ask that researchers follow these guidelines so we can investigate quickly and safely.
Do not disrupt service
Avoid any activity that could degrade the availability of COUNT services for other users. Do not run automated scanners at high volume.
Keep it confidential
Do not share issue details publicly until we have resolved the issue or agreed on a disclosure timeline together.
Safe harbor
We will not take legal action against researchers who follow this policy and act in good faith. We expect the same courtesy in return.
How to report
Send your report to security@getcount.com. We encourage encrypted transport (TLS). If you prefer PGP, let us know and we can make a key available.
Please include
- A clear summary of the issue.
- Steps to reproduce, with screenshots or video if helpful.
- The affected domain or URL.
- The potential impact.
- A suggested fix, if you have one.
- A way to contact you for follow-up questions.
What happens next
- Acknowledge: We aim to acknowledge your report within 48 hours.
- Validate: We confirm the issue and assess severity.
- Fix: We develop and test a fix.
- Verify: We confirm the fix resolves the issue.
- Disclose: We work with you on a responsible disclosure timeline.
We aim to provide a substantive update within 5 business days. Complex issues may take longer, and we will keep you informed of progress.
Bounty and acknowledgement policy
COUNT does not operate a paid bug-bounty programme or public Hall of Fame at this time. We do not publish researcher names or issue details without explicit agreement. We are grateful for responsible reports and will treat every reporter fairly and respectfully.
Have a security concern?
Email us directly. For general support questions, please use the support site instead.