Vulnerability Disclosure Policy

LAST UPDATED SEPTEMBER 2026

Launch Texas LLC (“Launch Texas”) takes the security of its systems and the information entrusted to it seriously. We welcome reports from security researchers and the public that help us identify and remediate vulnerabilities, and we commit to working with you in good faith.

1. Scope

This policy applies to launchtexas.com and its subdomains operated by Launch Texas.

The following are out of scope:

• Third-party services, platforms and embedded content that Launch Texas does not operate.
• Denial-of-service testing, or any testing that degrades service availability.
• Social engineering, phishing or physical attacks against our staff, members or facilities.
• Spam, or automated submissions to our inquiry forms.
• Findings without a demonstrable security impact, such as missing best-practice headers alone.

2. How to report

Send your report to info@launchtexas.com with the subject line “Security Vulnerability Report.” Please include:

• A description of the vulnerability and where it was found.
• Step-by-step instructions to reproduce it, including any proof-of-concept code.
• Your assessment of the potential impact.
• How you would like to be credited, if at all.

3. Guidelines

When researching vulnerabilities, you agree to:

• Act in good faith and avoid privacy violations, data destruction and service disruption.
• Access only the minimum data needed to demonstrate the issue. Stop and notify us immediately if you encounter personal or confidential information, and do not retain, share or further access it.
• Not exploit a vulnerability beyond what is necessary to confirm it.
• Keep the vulnerability confidential until we have remediated it, or until 90 days after your report, whichever comes first, unless we agree otherwise in writing.

4. Our commitments

• We will acknowledge your report within five business days.
• We will provide an initial assessment and keep you informed of our remediation progress.
• With your permission, we will publicly credit you once the issue is resolved.

5. Safe harbor

If you make a good-faith effort to comply with this policy, we will consider your research authorized, we will not initiate or support legal action against you, and if a third party brings legal action against you for activities conducted under this policy, we will make it known that your actions were authorized. This includes, to the extent within our control, claims under the Computer Fraud and Abuse Act and Chapter 33 of the Texas Penal Code. This safe harbor does not extend to activities outside this policy’s scope or guidelines.

6. No bounty

Launch Texas does not currently offer monetary rewards for vulnerability reports. Submission of a report does not create any contractual obligation.