Security & Responsible Disclosure

Wigiwork uses proportionate administrative, technical, and organizational safeguards intended to protect user information, candidate anonymity, confidential hiring workflows, accounts, and platform integrity.

No security, anonymity, verification, or access-control measure can guarantee that unauthorized access, misuse, recognition, inference, or re-identification will never occur.

Users must not bypass, disable, alter, reverse-engineer, or otherwise interfere with Wigiwork's security, confidentiality, anonymity, access-control, or content-protection safeguards, except through good-faith research conducted within the authorized scope of this policy.

Detailed anonymity limitations are described in Anonymous Profile Protections. Wigi-DNA™ scope and anti-tampering rules are described in Confidentiality & Wigi-DNA™.

Potential security vulnerabilities, privacy issues, or related technical concerns should be reported promptly to security@wigiwork.com.

A report should include, where reasonably available:

• a clear description of the issue and its potential impact;
• the affected Wigiwork service, feature, or account;
• reasonable steps for reproducing the issue;
• the date and circumstances in which it was identified; and
• limited supporting evidence necessary to explain the concern.

Do not include, access, collect, or retain more personal, confidential, credential, or security-sensitive information than reasonably necessary.

Researchers should avoid publicly disclosing the vulnerability before Wigiwork has had a reasonable opportunity to investigate and address the issue.

Wigiwork may request clarification or additional information and will aim to acknowledge and assess reports within a reasonable timeframe, subject to security, confidentiality, legal, and operational constraints.

Unless Wigiwork expressly provides different written authorization, security research is limited to:

• Wigiwork-owned public services made available for testing; and
• accounts, environments, and information that the researcher owns or has explicit permission to test.

Third-party systems, service-provider infrastructure, production resources not made available for testing, and other users' accounts or information are outside the authorized scope unless Wigiwork confirms otherwise in writing.

If you are unsure whether a system, account, environment, or testing method is within the authorized scope, contact security@wigiwork.com and obtain confirmation before testing.

Researchers must:

• use only the minimum access and testing reasonably necessary to investigate the suspected vulnerability;
• avoid accessing, viewing, copying, exporting, altering, or exposing information they are not authorized to access;
• stop testing if personal data, candidate identity information, credentials, confidential information, or system secrets become accessible; and
• comply with the prohibited-testing conditions in Section 6.

Testing outside this scope is not authorized under this policy.

Wigiwork considers security research conducted in good faith and in accordance with this policy to be authorized and will not initiate legal action based solely on that compliant research, provided it is conducted:

• in good faith;
• within the authorized scope of this policy;
• without harming users, information, systems, or platform availability;
• without unauthorized access, use, disclosure, or retention of personal or confidential information;
• in compliance with applicable law; and
• with reasonable reporting and disclosure coordination.

Safe-harbor protection does not apply to:

• activity outside the authorized scope;
• unauthorized access, extraction, copying, or disclosure of information;
• attempts to identify or deanonymize users;
• credential attacks, phishing, social engineering, impersonation, extortion, or threats;
• malware, destructive testing, or service disruption;
• concealment, exploitation, sale, or misuse of a vulnerability; or
• failure to stop testing or cooperate reasonably after unauthorized information or material risk is discovered.

Wigiwork may restrict, block, investigate, or take appropriate action against activity that is harmful, unlawful, deceptive, abusive, or outside this policy.

This safe harbor does not prevent Wigiwork from complying with legal process, responding to lawful requests, protecting users or its rights, preserving evidence, or notifying affected parties or authorities where required or permitted by law.

This safe harbor applies only to legal claims Wigiwork may control and does not bind third parties or government authorities.

If security research unintentionally exposes personal data, candidate identity information, credentials, confidential information, system secrets, or other information the researcher is not authorized to access, the researcher must:

• stop testing immediately;
• avoid further viewing, searching, copying, downloading, changing, using, or sharing the information;
• preserve only the minimum evidence reasonably necessary to report the vulnerability;
• report the incident promptly to security@wigiwork.com;
• keep the information confidential; and
• follow reasonable instructions from Wigiwork concerning containment, secure deletion, and protection of affected users or systems.

Reports must not include personal data, credentials, candidate identity information, confidential business information, or system secrets unless strictly necessary to identify and explain the vulnerability.

Accidental access does not authorize continued testing, retention, disclosure, publication, or use of the information.

Security research must remain within the authorized scope in Section 3.

Researchers must not:

• access or attempt to access another person's account, personal data, credentials, confidential information, or system secrets;
• identify, re-identify, trace, or deanonymize a candidate or other user;
• scrape, harvest, bulk-copy, extract, or systematically collect platform or user information;
• conduct credential attacks, phishing, social engineering, impersonation, coercion, or deception;
• introduce malware, exploits, bots, destructive code, or other harmful technology;
• disrupt, degrade, overload, damage, or interfere with Wigiwork or another user's activity;
• alter, delete, disclose, corrupt, or misuse information;
• manipulate platform features to expose identities or restricted information;
• interfere with Wigi-DNA™ or other security, confidentiality, access-control, or content-protection safeguards; or
• conduct unlawful, harmful, destructive, or out-of-scope activity.

Wigiwork may restrict or halt testing that violates these conditions or creates a material risk to users, information, platform stability, security, legal compliance, or Wigiwork's rights.

Wigiwork will assess vulnerability reports based on the information provided, the apparent risk, affected systems, and available technical, legal, and operational resources.

Where practicable, Wigiwork may:

• acknowledge receipt of the report;
• request clarification or additional evidence;
• investigate and validate the reported issue;
• take proportionate containment or corrective action; and
• provide status updates or confirm closure.

Wigiwork may limit information about its investigation, security measures, affected systems, remediation, or enforcement where disclosure could increase risk, expose confidential information, compromise another person's rights, or interfere with legal or security obligations.

Submitting a report does not create a service-level commitment, remediation deadline, disclosure deadline, contractual relationship, or obligation to provide continuing updates.

Wigiwork does not currently operate a formal bug-bounty or paid vulnerability-disclosure program.

Submitting a report is voluntary and does not create any entitlement to:

• payment, reward, reimbursement, or compensation;
• employment, contractor, agency, or partnership status;
• ownership or licensing rights in Wigiwork systems or corrective work; or
• any other contractual obligation.

Wigiwork may acknowledge or reward a significant contribution at its sole discretion, but any payment or other commitment must be separately confirmed by Wigiwork in writing.

Wigiwork may update this notice to reflect legal, security, operational, or service changes.

Updates are effective when posted unless Wigiwork states otherwise. The "Last Updated" date identifies the latest revision.

• Vulnerability reports: security@wigiwork.com
• Privacy concerns: privacy@wigiwork.com
• Legal matters: legal@wigiwork.com
• Urgent abuse issues: abuse@wigiwork.com