Security and vulnerability disclosure
If you find a security problem in anything we run, we want to hear about it. This policy explains how to report it and what you can expect from us.
Last updated November 1, 2026
How to report
Email security@gridhousellc.com with:
- the site or product and the address or feature affected;
- steps to reproduce the problem, and what an attacker could do with it;
- any proof-of-concept, screenshots or logs;
- how you would like to be credited, if at all.
Our machine-readable contact details are in security.txt.
In scope
- gridhousellc.com and portal.gridhousellc.com
- sentinelgrid.us and its subdomains
- getautodx.com and its subdomains
- rally.sentinelgrid.us
- verifyblox.xyz and the VerifyBlox bot
- synapsestudios.xyz
Each company may also list its own security contact; reports sent here reach the same team.
Out of scope
- Denial-of-service or load testing.
- Social engineering or phishing of our staff, customers or partners.
- Physical attacks on offices, equipment or people.
- Problems in third-party platforms, such as Roblox, Discord, Cloudflare or Stripe. Please report those to the platform.
- Reports from automated scanners without a demonstrated impact, missing best-practice headers with no exploit, clickjacking on pages with no sensitive actions, or self-XSS.
- Games and experiences inside Roblox, except where they talk to our own servers.
Rules for research
- Only test against accounts you own or have permission to use.
- Do not view, change, keep or share data that is not yours. If you reach someone else's data by accident, stop, tell us, and delete any copy.
- Do not degrade our services or disrupt other users.
- Give us a reasonable time to fix the problem before you tell anyone else. We ask for 90 days, or sooner once a fix is out.
- Do not test products used by children or schools in a way that could touch a student's data. Use the test accounts we can give you on request.
Safe harbor
If you follow this policy in good faith, we will consider your research authorized, we will not pursue legal action against you for it, and if someone else takes action against you over it we will make clear that you acted with our permission. This does not cover research that breaks the rules above or the law.
What to expect from us
- We will confirm we received your report within three business days.
- We will keep you updated while we investigate and fix it.
- We will credit you publicly when it is fixed, if you want.
We do not run a paid bug bounty at this time.