Help us protect every participant.

How to report

Use the public support form, select Security concern, and describe the affected page, what you observed, the potential impact, and safe steps we can use to reproduce it. You may also email security@demosightglobal.com. Form submissions receive a reference number and security reports receive elevated triage.

Protect people and data

Do not access, change, download, retain, or disclose another person’s information. Do not submit passwords, authentication tokens, government identifiers, payment information, or unnecessary personal data. If you encounter personal information, stop testing and report only the minimum detail needed to locate the issue.

Out of scope

Do not perform denial-of-service or load attacks, automated bulk submissions, phishing, social engineering, physical intrusion, credential stuffing, destructive testing, or testing against third-party services that Demosight does not control. Do not publicly disclose an unresolved issue in a way that increases risk to participants.

What happens next

Form submissions enter a restricted operations queue and receive an email acknowledgement. Demosight assesses severity, preserves evidence, contains confirmed risk, and tracks remediation and disclosure decisions.

Current assurance boundary

The application maintains an internal security baseline aligned toward OWASP ASVS and NIST CSF. It has not yet completed an independent penetration test and does not claim certification or external security assurance.