Responsible Disclosure Policy

This policy applies to all ScoreRaiser, Inc. systems, platforms, and infrastructure, including scoreraiser.com and our associated product brands. We authorize security research that is conducted in good faith and complies with the guidelines set forth in this document. If your research adheres to these principles, we will not initiate legal action or law enforcement investigations against you related to your findings.

To ensure a safe and productive disclosure process, we require all researchers to adhere to the following rules of engagement: • Do No Harm: Your research must not disrupt, degrade, or compromise the availability of our services. Do not execute denial-of-service (DoS) attacks or any testing that impairs system performance. • Protect User Data: You must not access, modify, delete, or exfiltrate data belonging to ScoreRaiser or our users. If you encounter user data during your research, you must immediately halt your activity and report the vulnerability. • Avoid Exploitation: Do not exploit a vulnerability further than necessary to establish its existence. Do not attempt to pivot to other systems, establish persistent access, or execute arbitrary code beyond a harmless proof of concept. • No Social Engineering: Do not target ScoreRaiser employees, contractors, or users with phishing, social engineering, or physical security attacks. • Keep Findings Confidential: You must maintain strict confidentiality regarding any discovered vulnerabilities until we have had adequate time to investigate and deploy a remediation.

If you believe you have discovered a security vulnerability within a ScoreRaiser system, please report it to us immediately. Submission Channel: Please submit your findings via email to: info@scoreraiser.com Report Requirements — To help us triage and resolve the issue efficiently, your report should include: • A clear description of the vulnerability and its potential impact. • The specific URL, endpoint, or system component affected. • Detailed, step-by-step instructions to reproduce the issue. • Any relevant proof-of-concept code, screenshots, or logs.

The following types of issues are generally considered out of scope for this policy and should not be reported unless they demonstrate a severe, exploitable impact: • Missing security headers or flags (e.g., HTTP Only, Secure) without a demonstrable exploit. • Rate limiting or brute-force issues on non-critical endpoints. • Self-XSS or issues requiring unlikely user interaction. • Vulnerabilities in third-party services or integrations not directly controlled by ScoreRaiser. • Theoretical vulnerabilities without a functional proof of concept.

When you submit a vulnerability report in accordance with this policy, ScoreRaiser commits to the following: • Prompt Acknowledgment: We will acknowledge receipt of your report within a reasonable timeframe. • Transparent Communication: We will keep you informed of our progress as we investigate and validate your findings. • Timely Remediation: We will prioritize the remediation of validated vulnerabilities based on their severity and potential impact. • Recognition: With your permission, we may publicly acknowledge your contribution to the security of the ScoreRaiser ecosystem once the vulnerability has been resolved.

ScoreRaiser considers research conducted in compliance with this policy to be authorized. We will not pursue civil action or initiate a complaint to law enforcement for accidental, good-faith violations of this policy. However, we reserve the right to take appropriate action if a researcher acts maliciously, causes intentional harm, or violates the confidentiality requirements outlined herein. If you have any questions regarding the scope of this policy or whether a specific testing methodology is permitted, please contact us before proceeding: ScoreRaiser, Inc. 2 Davis Drive P.O. Box 13169 Research Triangle, NC 27709 Email: info@scoreraiser.com