Found a security problem? Tell us, and here is what happens next.

How to report

Email security@virtualcloser.com. Put the details in the body of the email: the affected URL, app or endpoint; the steps to reproduce; what an attacker could do with it; and the account you tested with. We do not open attachments, videos or outside links from people we do not know, so a report that only links to a write-up may not be read.

The same contact is published in machine-readable form at /.well-known/security.txt (RFC 9116).

What we commit to

• We acknowledge a report within 3 business days.
• We give an initial assessment (valid, by design, or not reproducible) within 10 business days.
• We tell you when a valid issue is fixed, and we ask that you wait until then, or 90 days from your report, whichever comes first, before talking about it in public. If a fix needs longer we will say why.
• We will not ask you to sign anything to report a vulnerability.

No paid bounty

We do not run a paid bug bounty and do not pay for reports. A report that asks for payment before sharing the details is not a good-faith report under this policy.

In scope

Our own assets only:

• virtualcloser.com and every *.virtualcloser.com host we run
• runmyads.com and app.runmyads.com
• sakredcrm.com, sakredagents.com and *.sakredagents.com
• suitecxo.com and *.suitecxo.com
• The Virtual Closer, Run My Ads and Suite CXO mobile apps
• Our AI connectors (MCP servers) and their sign-in endpoints

Out of scope

• Open OAuth Dynamic Client Registration for AI clients. Any client can register itself on our MCP sign-in server. This is by design (RFC 7591 and the MCP authorization spec): registration grants no access by itself, and every connection still needs a signed-in user to approve it on our consent screen, with exact-match https redirect URIs, PKCE and rate limits. Reports that only show a client can register are closed as by design.
• Systems we do not own: our vendors (for example hosting, database, payment, phone and email providers) and any agency's own website or custom domain content. Report those to their owners.
• Denial of service, load or volume testing, and spam or automated form submissions.
• Social engineering, phishing or physical attacks on our staff, agents, partners or offices.
• Findings from automated scanners without a demonstrated, working impact; missing security headers, cookie flags or email-authentication (SPF, DKIM, DMARC) settings on their own; version or banner disclosure; clickjacking on pages with no sensitive action; self-XSS; logout CSRF; rate limits on non-sensitive endpoints.
• Issues that need a compromised device, a rooted phone or a stolen password.

Rules for testing

• Use only accounts you created yourself. Never access, change or delete data that is not yours; if you reach someone else's data, stop, do not keep a copy, and tell us.
• Never send texts, calls or emails to phone numbers or addresses you do not own. Our apps contact real consumers and agents, and those people did not agree to your test.
• Do the least needed to prove the issue, then stop.
• Keep the details private until we have fixed it (see above).

Safe harbor

If you make a good-faith effort to follow this policy, we will consider your research authorized, we will not pursue or support legal action against you for it, and if a third party takes legal action against you over research that followed this policy we will make it known that your work was authorized by us. This covers only our own systems listed above; we cannot authorize testing of anyone else's. If you are unsure whether something is allowed, ask us at security@virtualcloser.com before you test.

For how we handle your agency's data and what we do not claim, see Security & data handling.