Legal

Responsible Disclosure

Last updated: June 29, 2026

GCPR Communications LLC LLC welcomes security research on GCPR. If you believe you have found a vulnerability, please report it through the channel below. We commit to acknowledge valid reports promptly and to work in good faith with researchers who follow this policy.

1. How to report

Email security@gcprhq.com with:

A clear description of the vulnerability and its impact.
Steps to reproduce, including affected URL(s) and any payloads.
Your name or handle for credit (optional).

We will acknowledge your report within 3 business days and provide a remediation timeline once triaged.

2. Scope

In-scope assets:

gcprhq.com and all subdomains
globalconnectpr.com and all subdomains
gosynqtech.com and all subdomains
Our public APIs and server functions

Out of scope (please do not test):

Third-party services (Stripe, Supabase, Cloudflare, Resend, Google) — report directly to the provider.
Denial-of-service, volumetric, or brute-force attacks.
Social engineering of staff, customers, or vendors.
Physical attacks against our offices or staff.
Spam or content-injection that does not bypass a security control.
Reports generated solely by automated scanners without proof of impact.

3. Safe harbor

We will not pursue legal action against researchers who, in good faith:

Stay within the in-scope assets above.
Avoid privacy violations — do not access, modify, or exfiltrate data belonging to other customers, and use only test accounts you create.
Do not degrade or disrupt the service for other users.
Give us reasonable time to remediate before public disclosure (we target 90 days; complex issues may require longer by mutual agreement).

Activity consistent with this policy is authorized and we will not consider it a violation of the Computer Fraud and Abuse Act, the DMCA, or our Terms of Service.

4. Rewards

We do not currently operate a paid bug bounty. We do publicly credit researchers on request once a fix is shipped.