Security

Last reviewed 2026-09-16

Helys holds artists' funding pipelines, application drafts, uploaded work samples and — for eligibility screening — demographic information. We take reports seriously.

Reporting a vulnerability

Email security@helys.com with enough detail to reproduce the issue. Please include the affected URL or endpoint, the steps you took, and what you observed. If you have a proof of concept, a minimal one is more useful than a weaponized one.

Expect an acknowledgement within 3 business days and an assessment within 10. We will tell you when the issue is fixed and whether we would like to credit you.

Please do not open a public issue for a security report.

Safe harbor

We will not pursue or support legal action against anyone who, in good faith:

• reports a vulnerability promptly and privately,
• makes a genuine effort to avoid privacy violations, data destruction, and interruption of the service,
• accesses only their own accounts and data, or accounts they have explicit permission to test, and
• gives us reasonable time to remediate before disclosing.

We do not run a paid bug bounty.

Contact

security@helys.com for security reports, support@helys.com for everything else. This page is the Policy URL in /.well-known/security.txt.