Vulnerability Disclosure Policy

Milli welcomes the work of security researchers who help keep our customers safe. This policy describes how to report a vulnerability, what you can expect from us, and the safe harbor we provide for good-faith research.

1. How to Report

Email security@drivemilli.com with the subject line "Vulnerability Report" and include: - a description of the vulnerability and its potential impact; - the affected asset (URL, app version, or API endpoint); - step-by-step instructions to reproduce, with proof-of-concept code or screenshots; and - your name or handle, if you would like to be credited.

Please do not include customer data in your report. If you need to share sensitive details, ask us for an encrypted channel.

2. Our Response Commitments

Stage	Commitment
Acknowledgement	Within 24 hours of receipt
Initial triage and severity assessment	Within 3 business days
Status updates	At least every 7 days until resolved
Remediation target: Critical	Within 7 days
Remediation target: High	Within 30 days
Remediation target: Medium	Within 60 days
Remediation target: Low	Within 90 days
Notification of fix	When the fix is deployed

We will work with you on coordinated public disclosure after the issue is resolved, and with your permission we will credit you on our security acknowledgements page.

3. In Scope

drivemilli.com and its subdomains operated by Milli
The Milli iOS and Android applications (current production versions)
Milli production APIs used by the apps

4. Out of Scope

Denial-of-service or load testing of any kind
Social engineering, phishing, or pretexting of Milli employees, contractors, or customers
Physical attacks against Milli offices, personnel, or data centers
Third-party services and platforms, including Plaid, our website hosting provider, Apple, Google, Visa, and our card processor (report to those vendors directly)
Spam, or automated scanner output without a demonstrated security impact
Missing security headers, cookie flags, or best-practice configurations without a demonstrable exploit
Clickjacking on pages with no sensitive actions
Attacks requiring a rooted or jailbroken device, or physical access to an unlocked device
Vulnerabilities in outdated browsers or operating systems

5. Rules of Engagement

Only test against accounts you own or have explicit permission to use.
Do not access, modify, delete, or retain data belonging to others. If you encounter customer data, stop, and report it to us immediately.
Use the minimum testing necessary to demonstrate a vulnerability.
Do not degrade service availability or move money.
Give us reasonable time to remediate before any public disclosure.

6. Safe Harbor

If you make a good-faith effort to comply with this policy, Milli will consider your research authorized; will not pursue or support legal action against you under the Computer Fraud and Abuse Act, the Digital Millennium Copyright Act, or similar laws; will waive restrictions in our Acceptable Use Policy that would interfere with conducting security research under this policy; and will work with you to understand and resolve the issue quickly. If legal action is initiated by a third party against you for activities conducted under this policy, we will make it known that your actions were authorized.

7. Rewards

Milli does not currently operate a paid bug bounty program. We recognize valid, original reports through public acknowledgement and may offer discretionary rewards for exceptional findings.