Legal
Responsible disclosure
If you find a vulnerability in this website or the form worker, we want to hear about it.
Effective 9 November 2026
How to report
Email [email protected]. Include what you found, how to reproduce it, and the impact you believe it has. Please do not include passwords, private keys, or personal data belonging to someone else.
There is also a security.txt file for this site.
In scope
- The migrateforge.com website.
- The form Worker that receives migration-report requests.
Out of scope
- Customer applications and anything that is not this website or its form Worker.
- Social engineering, physical attacks, and denial of service.
- Scanning that degrades the site for other people.
What we will do
We aim to acknowledge a report within five business days. Please give us a reasonable time to fix a confirmed issue before you publish it. We will not take legal action against research that follows this policy, stays in scope, and avoids privacy harm and service degradation.
This site does not advertise a paid bounty.