Security and Responsible Disclosure
Effective date: · Version 1.0
AskGAAP is pre-launch. This page describes the controls and reporting channel for the current public website. It does not claim that the future customer application has completed a certification, audit, penetration test, or production-readiness review.
1. Public-site controls you can inspect
- HTTPS with HTTP Strict Transport Security.
- A hash-pinned Content Security Policy, clickjacking restrictions, MIME-sniffing protection, and a constrained permissions policy.
- Self-hosted fonts and a bounded list of third-party network destinations.
- Content-security-policy reporting and browser error monitoring through Sentry.
- Form handling through named Formspree endpoints with both platform and custom honeypot fields.
Strict-Transport-Security (preload), frame-ancestors 'none',
X-Content-Type-Options: nosniff, and a locked Permissions-Policy — verifiable
today with the same curl -I any auditor runs. Script execution is constrained by a
hash-based strict-dynamic Content-Security-Policy in _headers.
These are website controls, not a security certification. Product controls such as tenant isolation, customer-data handling, model-provider configuration, signing operations, incident response, and software-bill-of-materials publication remain separate pre-launch evidence gates.
2. Report a vulnerability
Email security@askgaap.ai with the subject line Security report. Include the affected URL, a concise description, reproducible steps, impact, and any safe proof that helps us validate the issue. Do not include personal data, credentials, confidential third-party information, or unnecessary exploit data.
Our machine-readable contact is also published at /.well-known/security.txt. We do not currently operate a bug-bounty program and do not promise payment.
3. Good-faith testing boundaries
Limit testing to the publicly accessible askgaap.ai website and your own data. Do not:
- access or attempt to access another person's data or account;
- use denial-of-service, resource-exhaustion, destructive, persistence, or social-engineering techniques;
- send spam, submit high-volume forms, degrade availability, or alter public content;
- test third-party providers such as Netlify, Formspree, Google, Microsoft, or Sentry through our site; or
- publicly disclose an unresolved issue before we have had a reasonable opportunity to investigate and address it.
Stop immediately and report the issue if you encounter personal, confidential, or customer data. These guidelines do not authorize conduct prohibited by law or by a third party's terms.
4. What happens after a report
We will triage credible reports, may ask for additional information, and will coordinate remediation and disclosure when appropriate. Response and remediation time depend on severity, reproducibility, affected systems, and third-party dependencies; no fixed service level is promised on this pre-launch site.
5. Claims boundary
AskGAAP does not currently claim SOC 2 certification, ISO certification, independent security attestation, guaranteed data residency, or guaranteed auditor acceptance. Procurement evidence and product security terms will be published or provided only after their named controls and evidence receipts are complete.