Trust
Security & responsible disclosure
How BenchPath is secured, and how to report a vulnerability. Last updated 2026-07-21.
The trust boundary
BenchPath's web application contains no server secret. Public pages read through a publishable key; access to private data (your profile, matters, follows, and alerts) is enforced at the database by row-level security, so records are readable only by their owner. Authorization attributes — reviewer and administrator roles — are server-controlled and cannot be changed by an ordinary authenticated account. Privileged automation runs with least privilege and is not reachable by ordinary users.
Transport & browser hardening
The site is served over HTTPS with HSTS. Responses carry a baseline of browser-security headers — frame protection, MIME-sniffing protection, a strict referrer policy, a restrictive permissions policy, and cross-origin isolation — with a content-security policy being rolled out in stages.
Reporting a vulnerability
If you believe you have found a security issue in benchpath.ai, please report it through the contact form and mark it as a security report. Give us enough detail to reproduce the issue, and please give us a reasonable window to remediate before any public disclosure.
Safe harbor
We will not pursue action against good-faith security research that respects user privacy, avoids degrading the service, does not access or modify data that is not yours, and gives us a reasonable time to fix the issue. Do not run automated scanners against production, do not attempt denial-of-service, and never access another user's private records.
Out of scope
Reports that a public record (a court order, a judge's published procedures) is visible are not vulnerabilities — that content is public by design. Corrections to the accuracy of a published entry go through the corrections process, not this one.