Last updated Aug 2, 2026

Security

Found a vulnerability? Email us. A person reads every report.

1. Scope

This covers forwardmarch.vet and its subdomains: the site, the sign-in flow, and the API behind it. It does not cover VA.gov, Stripe, or Amazon Web Services — report a problem with one of those directly to that company.

2. What we ask

Give us enough to reproduce it: the URL, the steps, and what you expected versus what happened. Don't read, change, or delete anyone else's data — including anyone's VA claim information — beyond the minimum needed to show the problem is real. Don't run automated scanners against production without asking first; email us and we'll work out a safe way to test. Give us a reasonable window to fix it before you post it publicly.

3. What to expect

We don't run a paid bug bounty program, and we can't promise payment for a report. What we do: read it, ask follow-up questions if we need them, and fix real problems. We'll tell you when it's fixed.

4. Contact

Email devs@forwardmarch.vet. Machine-readable contact details are also at /.well-known/security.txt, per RFC 9116.