SECURITY &
TRUST.

Email ilove@getreadyandjump.com with "Security" in the subject line.

Say what you found, where (the page or API route), how to reproduce it step by step, and what an attacker could do with it.

Use only accounts you own or test accounts you create. If you reach somebody else’s data, stop, do not keep or share it, and tell us what you saw.

Give us a reasonable time to fix it before you tell anybody else. We will agree a date with you; we aim for 90 days or sooner.

A person reads every report and answers within 72 hours.

We tell you when it is confirmed, when it is fixed, and if we disagree with your assessment, why.

We credit you publicly when it is fixed, if you want to be credited.

GRAJ does not offer cash rewards yet.

In scope: getreadyandjump.com, www.getreadyandjump.com, every page and API route under them, and the GRAJ mobile apps (which load the same site). The list of what we most want to hear about is below, read off the door that receives reports.

Out of scope — please do not:

· Testing that degrades the service for other people (load or denial-of-service testing, spam, automated scanning at volume).

· Social engineering of anybody, physical attacks, and attacks on other people’s accounts or devices.

· Anything that spends money: placing real orders or payments, or calling the AI agents in bulk (each call is billed).

· Reports from automated scanners with no demonstrated impact, missing best-practice headers alone, and issues needing an unlikely user action.

If you make a good-faith effort to follow this policy, we will consider your research authorized, we will not pursue or support legal action against you for it, and if somebody else brings action against you for research that followed this policy, we will make it known that it was authorized. Good faith means you avoided harm to people and their data, did not spend or move money, did not keep data you reached, and gave us the time to fix the issue before disclosing it.