# Security and vulnerability disclosure policy

**Juriansz Estate Services Group** · https://www.jurianszestateservices.ca
Website security is managed on the firm's behalf by **Applied AI North**.
Last updated: 2026-10-14

We handle confidential information for families and estates, so we take reports about the security of this website seriously and we welcome them.

## How to report

Email **security@appliedainorth.com** (fallback: hello@appliedainorth.com). Please include:

- the URL or component affected and what the issue is;
- steps to reproduce, or a proof of concept;
- what an attacker could do with it;
- how we can contact you (anonymous reports are accepted).

Do **not** include personal information you may have come across. If you accessed anyone's data, tell us what kind it was, stop, and delete any copy you hold.

## What we commit to

| Step | Target |
|---|---|
| Acknowledge your report | within 2 business days (usually much sooner) |
| Initial assessment and severity | within 5 business days |
| Fix or mitigation for a confirmed critical or high issue | as fast as possible, normally within 7 days |
| Tell you when it is fixed | yes, and credit you if you want it |

## Scope

In scope:

- `www.jurianszestateservices.ca` and its redirecting domains
- the consultation form endpoint `/api/contact`

Out of scope:

- third-party services we use (Vercel, Supabase, Resend, Google): report those to the vendor
- denial-of-service, load or volumetric testing
- social engineering, phishing, or physical attacks on the firm or its staff
- automated scanner output with no demonstrated impact
- missing best-practice headers or DNS records without a working exploit
- spam submissions through the contact form

## Safe harbour

If you act in good faith, follow this policy, avoid privacy violations and service disruption, and give us reasonable time to fix an issue before disclosing it, we will not pursue or support legal action against you for your research. If you are unsure whether something is allowed, ask first.

## Rules

- Test only against your own submissions. Do not access, change or delete other people's data.
- Do not submit real personal information through the form while testing.
- Keep the issue confidential until we confirm it is fixed (we aim for no more than 90 days).

## Rewards

This is a small private practice. There is **no bug bounty** and no payment for reports. We are glad to credit you publicly with your permission.

Machine-readable contact details: [/.well-known/security.txt](https://www.jurianszestateservices.ca/.well-known/security.txt)