Effective Date: August 18, 2026
1. Our Commitment
At Perusall, we believe that security is a collaborative effort. We value the expertise of researchers who help us protect the educational environments of our students and faculty. This policy establishes a framework for how we can work together to identify and fix vulnerabilities in a way that is safe, transparent, and respectful of user privacy.
2. Authorization & Safe Harbor
If you conduct security research and vulnerability disclosure in accordance with this policy, we will consider your activities to be authorized. This authorization is offered to any researcher acting in good faith within the scope of this policy, and it applies whether or not you have registered an account or otherwise agreed to our Terms of Service. To the extent any activity conducted in good faith compliance with this policy would otherwise be restricted by our Terms of Service (including, without limitation, the Acceptable Use provisions prohibiting probing, scanning, or testing the vulnerability of any system, or breaching or circumventing security or authentication measures), we authorize that activity and waive those restrictions as applied to your in-scope research. “Good faith” means a genuine, reasonable effort to comply with this policy; we will interpret your activities in good faith and will not consider a minor, inadvertent deviation to forfeit authorization.
Provided you comply with this policy, Perusall will not: (a) initiate or pursue legal action against you, or refer you to law enforcement, for your in-scope research; (b) bring any claim against you under the Computer Fraud and Abuse Act (CFAA), the Digital Millennium Copyright Act (including 17 U.S.C. 1201), or any analogous state computer-crime, anti-hacking, or anti-circumvention law; (c) bring any breach-of-contract claim under our Terms of Service arising from your in-scope research; or (d) seek indemnification from you under our Terms of Service for that in-scope research. If a third party initiates legal action against you for activity conducted in good faith compliance with this policy, we will take reasonable steps to make known, publicly or to the relevant authority or court, that your activity was authorized under this policy. Nothing in this policy authorizes activity that is inconsistent with it, and this policy does not waive any rights with respect to conduct that falls outside its scope.
3. Respect for Privacy
Your research must never compromise the privacy or data of Perusall users. To maintain authorization, you must adhere to the following:
- Test in Perusall’s staging environment only: You may not test in Perusall’s production environment. Any testing must be done using the staging environment at https://staging.perusall.com.
- Avoid PII: If you discover a way to access data, you must only use your own test accounts to demonstrate the vulnerability.
- Hard Stop: If you inadvertently encounter data that is not yours (such as student records, grades, or faculty information), you must stop testing immediately. Do not view, cache, print, copy, or share the data.
- Reporting & Destruction: Report the incident to us immediately. Upon our confirmation of receipt, you must securely delete any data inadvertently downloaded or cached before you stopped. This will be treated as a high-quality, good faith report, provided you did not intentionally attempt to exfiltrate data.
4. Ground Rules for Testing
Any activities that could potentially impact users or platform stability are strictly prohibited. These include, but are not limited to:
- Disruption: Do not perform any testing that could degrade the experience of our users (e.g., Denial of Service (DoS), spamming, or resource exhaustion).
- Social Engineering: Do not attempt to phish, deceive, or physically interact with Perusall staff, faculty, or students.
- Data Integrity: Do not delete, alter, or corrupt any data that does not belong to you.
- Persistence & Pivoting: Do not use a vulnerability to establish a "backdoor" or permanent access or attempt to move from a compromised system to other internal Perusall systems.
5. Proprietary Information & Confidential Data
Vulnerabilities may sometimes expose sensitive, non-user-related corporate data (e.g. source code, system configuration, copyright-protected or licensed content and other course materials). If you discover or gain access to any proprietary information belonging to Perusall, its users, or partners, you must treat it with the same diligence as user data, following the same rules as above.
6. Compensation & Recognition
Perusall does not offer financial rewards or "bug bounties" as a standard practice. We do not respond to solicitations for payment or inquiries regarding reward tables. Our goal is to build a relationship based on mutual respect. We are committed to:
- Acknowledging receipt of your report promptly.
- Providing a timeline for remediation.
- Offering a formal letter of appreciation or public credit (if desired) for significant, verified findings once they are resolved.
7. Submission & Response Process
Please send your findings to security@perusall.com. To help us address the issue quickly, your report should include:
- A description of the vulnerability and its potential impact.
- Concise, reproducible steps or a script. Reports consisting only of screenshots or automated scanner exports will not be prioritized.
- Specific URL(s), API endpoint(s), or component(s) involved.
8. Coordinated Disclosure
We ask that you give us a reasonable amount of time to remediate a vulnerability before you share any information about it publicly. We will acknowledge your report promptly and, in return, promise to be transparent with you about our progress. Do not disclose any details to third parties or the public until we have provided written confirmation that the issue is resolved.
9. Legal Ownership
By submitting a report to Perusall, you grant Perusall a perpetual, irrevocable, worldwide, royalty-free, and non-exclusive license to use your findings to remediate and prevent vulnerabilities, operate and improve the security of our platform, and comply with our legal and regulatory obligations. You represent that your report is your own original work, does not infringe the rights of any third party, and does not contain confidential or proprietary information belonging to anyone other than Perusall.
10. General
This policy is governed by the laws of the State of Delaware, without regard to its conflict-of-laws rules, consistent with our Terms of Service. If any part of this policy is found to be unenforceable, the rest will remain in full effect. We may update this policy from time to time by posting a revised version, and the version in effect when you conduct your research will apply.
Related to