Found a potential security issue in Qubeforms? Report it privately to security@qubeforms.com. This policy explains the scope, how to test safely, and what to include in your report. You can also review our security overview and Privacy Policy.
Our approach
Qubeforms is operated by Qubus Labs, LLC. We welcome reports from researchers who identify potential security vulnerabilities in good faith and help us protect customers and their information. Read this policy before testing or reporting an issue, keep your work non-destructive, and give us a reasonable opportunity to investigate and address it.
Scope
This policy covers the Qubeforms application on qubeforms.com and its API on api.qubeforms.io, including our customer dashboard, form submission and draft endpoints, submission read API, and Qubeforms-operated account and billing integration. Limit testing to accounts, forms, submissions, and destinations you own or have explicit permission to use for testing. Customer websites embedding Qubeforms, customer email accounts and webhook receivers, and third-party hosting, storage, payment, or CAPTCHA services are outside this policy's authorization. A link or integration does not make a third-party system part of the scope. Contact us before testing if you are unsure about a system or technique.
How to report a vulnerability
Email security@qubeforms.com with a descriptive subject. Include the affected domain, page, feature, or endpoint; the potential impact; the conditions needed to trigger the issue; and clear steps to reproduce it using a minimal, non-destructive proof of concept. Where helpful, include the approximate UTC time, request identifiers, response status, and redacted request or response excerpts. Explain the expected behavior and what you observed. Use synthetic test data and redact credentials and personal information. Providing a reply address helps us ask questions and share progress; you may also report anonymously.
Testing safely
Use your own test accounts and forms, synthetic submissions, and email or webhook destinations you control. Keep request volumes low and stop once you have enough evidence to establish the issue. For access-control checks, use test accounts you control on both sides of the permission boundary. Do not use another customer's form keys, read keys, draft tokens, or attachment links to explore their data. If a finding needs additional access or a potentially disruptive technique to confirm, describe the evidence you already have and contact us before proceeding.
Activities that are not permitted
Do not perform denial-of-service testing, load testing, high-volume scanning, brute-force attacks, credential stuffing, phishing, social engineering, or physical attacks. Do not modify or delete other people's information, send unsolicited mail, upload malware, establish persistence, or move into other systems. Do not bypass plan limits to consume resources or trigger charges. Do not use a discovered weakness for any purpose beyond the minimum demonstration needed to report it, and do not demand payment or threaten disclosure in exchange for withholding a report.
Protecting personal information and secrets
If you encounter another person's submissions, files, credentials, payment information, or other sensitive data, stop testing and notify us promptly. Do not download additional records, enumerate affected customers, or share the information with others. The initial report should describe the exposure without including live secrets, complete submissions, or unnecessary personal information. Contact us to arrange a secure transfer if sensitive evidence is essential. Protect any evidence already collected, retain only what is needed to coordinate the report, and securely delete it as soon as it is no longer required, subject to applicable law.
Qubeforms behavior to consider
Public form keys are designed to appear in website code and do not grant access to read submissions or manage an account. Read API keys and draft access tokens are private credentials. Attachment download URLs are time-limited access links and should be treated as sensitive. Origin rules and spam controls have different purposes from account authentication, and some controls depend on the active plan and form settings. When reporting a weakness in these areas, explain the actual unauthorized access, data exposure, or other security impact. A scanner result or a missing recommended setting alone may not establish an exploitable vulnerability; meaningful transport-security findings are welcome.
What to expect after reporting
We aim to acknowledge reports promptly, investigate the reported behavior, and prioritize remediation based on impact, severity, and exploitability. We may ask for clarification or a safer reproduction and will seek to keep you informed of material progress and the outcome where we can. Investigation and fixes may depend on complexity or third-party coordination, so this policy does not promise a specific acknowledgment, triage, or remediation deadline. You may follow up on the original email thread if you have not heard from us or have additional evidence.
Coordinated disclosure
Please coordinate publication with us and allow a reasonable opportunity to investigate and remediate before making exploit details public. We will discuss an appropriate disclosure timeline based on the risk to customers and the work required. Do not publish personal information, active credentials, or access links. Any public acknowledgment of a researcher will be discussed with that researcher first.
Good-faith research and legal boundaries
Qubus Labs, LLC will handle reports and research that follow this policy constructively and in good faith. This policy covers only the limited, non-destructive research described here on the Qubeforms systems in scope. It does not permit unlawful activity, privacy violations, service disruption, or access to third-party systems, and it cannot grant permission on behalf of customers or other providers. Comply with applicable law and contact us before continuing whenever scope or authorization is unclear.
Rewards
This responsible disclosure process does not offer or promise monetary rewards. Any compensation would require a separate written agreement with Qubus Labs, LLC. You do not need to request or receive a reward to submit a report.
Policy updates
We may update this policy as Qubeforms and our reporting process change. The date shown on this page identifies the latest revision. Review the current scope and guidance before starting new testing.
Contact
Send vulnerability reports and questions about this policy to Qubus Labs, LLC at security@qubeforms.com. For account, billing, or general product help, contact support@qubeforms.com or use our contact page.