Security at QueueForge

Our commitment

Security is not an afterthought at QueueForge — it is a core part of how we build, operate, and maintain our infrastructure. We design our systems with the principle of least privilege, keep dependencies up to date, and continuously monitor for anomalies. Protecting the data and services our customers rely on is one of our highest obligations.

Responsible disclosure

If you believe you have found a security vulnerability in QueueForge's services, infrastructure, or website, we encourage you to let us know. We genuinely appreciate responsible security research and will do our best to investigate and address valid reports in a timely manner. We ask that you give us a reasonable amount of time to remediate the issue before disclosing it publicly.

How to report

Please send your findings to our dedicated security address. Include a clear description of the vulnerability, the steps to reproduce it, and any relevant proof-of-concept material. The more detail you provide, the faster we can triage and respond.

Rules of engagement

We welcome responsible research and want to make it easy for security-minded people to work with us. At the same time, we ask everyone who researches our systems to follow these guidelines:

• →Only test against accounts and data you own or have explicit permission to access.
• →Do not access, modify, delete, or exfiltrate data belonging to other users or QueueForge.
• →Do not perform automated scanning, fuzzing, or load-testing against our production infrastructure.
• →Do not conduct denial-of-service (DoS/DDoS) attacks or attempt to degrade service availability.
• →Do not exploit a vulnerability beyond what is strictly necessary to demonstrate its existence.
• →Do not perform social engineering attacks against QueueForge employees or contractors.
• →Act in good faith and comply with all applicable laws and regulations — including those of your own jurisdiction.

Out of scope

The following issue types are generally considered out of scope for security reports:

• –Missing HTTP headers with low or no security impact (e.g. X-Frame-Options on non-sensitive pages).
• –Clickjacking on pages without sensitive actions.
• –Self-XSS that requires the victim to enter malicious input themselves.
• –Rate-limiting on non-authentication endpoints.
• –Vulnerabilities in third-party services that QueueForge does not control.
• –Findings from automated scanners submitted without manual verification.
• –Issues related to outdated browser versions or client-side configurations.

Bug bounty

We currently do not operate a bug bounty program and are unable to offer monetary rewards for vulnerability reports. We are nonetheless grateful for any responsible disclosure and will acknowledge your contribution where appropriate.

Legal

QueueForge will not take legal action against security researchers who discover and report vulnerabilities responsibly, in full compliance with this policy. We ask that all research is conducted lawfully and without causing disruption, damage, or harm to our platform or its users. We reserve all rights to pursue legal remedies where actions go beyond what is described in this policy — including unauthorized access, data exfiltration, or deliberate service disruption.