NachoCrunch

🛡️Security & Responsible Disclosure

NachoCrunch takes security seriously. If you've discovered a vulnerability in any of our systems, we want to hear from you. We'll respond quickly, credit you (if you wish), and work with you to fix the issue before public disclosure.

📜 Responsible Disclosure Policy Active

We welcome reports from security researchers acting in good faith. If you follow this policy, we will:

Acknowledge your report within 48 hours
Provide an initial triage outcome within 5 business days
Keep you updated throughout remediation
Credit you in our Hall of Fame (opt-in) once fixed
Not pursue legal action for research that follows this policy

Please do:

Give us reasonable time to respond before any public disclosure
Avoid accessing data that isn't yours; stop and report if you encounter PII
Test only against your own accounts or accounts you have permission to use

Please don't:

Run automated scans that degrade service (DoS / DDoS / volumetric)
Exfiltrate customer or partner data
Perform social-engineering attacks against NachoCrunch employees

🎯 Scope

In Scope

app.nachocrunch.com
api.nachocrunch.com
Public rate-quote endpoints
Embeddable widget JS
Authentication / RBAC flows

Out of Scope

Third-party integrations (Encompass, Calyx, etc.)
Vendor SaaS dashboards we embed from
Physical security / social engineering
Rate-limit bypass by distributed IPs
Self-XSS or browser-only issues

💰 Bounty Program Pre-launch

Our bug bounty program is being formalized. In the meantime, we recognize significant findings with swag, Hall of Fame credit, and — at our discretion — cash rewards for critical impact reports. Contact security@aspirehomeloans.com for details.

📬 File a Report

Use this form to submit a vulnerability report. You'll receive a tracking token you can use to check status at any time. For sensitive reports, you may encrypt the contents with our PGP key (below) and email them directly.

Name (optional)

Email *

Organization (optional)

Vulnerability Type *

Severity *

Affected endpoint / URL (optional)

Description *

Steps to reproduce (optional)

Impact assessment (optional)

Proposed mitigation (optional)

Prefer email? Send your report to security@aspirehomeloans.com. We reply to every report.

🔐 PGP Key

For particularly sensitive reports, encrypt with our PGP key:

🏆 Hall of Fame

Researchers who have helped make NachoCrunch safer will be listed here (opt-in). Be the first — submit a report above.