Vulnerability Disclosure Policy · Last updated: October 29, 2026
Impulse Hosting is operated by Practical Objects, LLC (d/b/a Impulse Hosting), Dallas, Texas. We welcome reports from security researchers who find vulnerabilities in our systems, and we work with them to fix issues quickly. This policy explains how to report a vulnerability, what is in scope, and how we protect researchers who act in good faith.
Reports are handled through HackerOne. Use the form below to submit a report; it goes straight to our security team. You can also email security@impulsehosting.com.
impulsehosting.com and its subdomains operated by Impulse Hosting, including:
www.impulsehosting.com
dev.impulsehosting.com
control.impulsehosting.com (customer portal and control panel)
Services operated by Impulse Hosting on impulse.host, including:
beta.impulse.host
ImpulseDB, ImpulseAuth, and ImpulseDrive (beta)
The following are out of scope:
Websites, applications, and content hosted by our customers
Denial-of-service or volumetric/load testing
Social engineering or phishing of our staff, contractors, or customers
Physical attacks against offices, data centers, or equipment
Spam or sending unsolicited messages
Third-party services and platforms not operated by Impulse Hosting
Findings from automated scanners without a working proof of concept
Missing best-practice headers or configurations without a demonstrated security impact
3. Rules of Engagement
Test only against accounts and resources you own or have explicit permission to use.
Do not access, modify, or exfiltrate data beyond the minimum needed to demonstrate the issue.
Do not violate the privacy of our customers or staff, or degrade our services.
If you access customer data or another user’s information, stop immediately and report it to us.
Give us a reasonable time to fix the issue before any public disclosure. Our default coordinated disclosure window is 90 days from your report.
4. What to Include in a Report
The affected system, URL, or component
A description of the vulnerability and its potential impact
Step-by-step instructions to reproduce it, with a proof of concept where possible
Any relevant screenshots, requests/responses, or logs
How you would like to be credited, if at all
5. Our Commitments
We will acknowledge your report within 3 business days.
We will keep you informed as we investigate and fix the issue.
With your permission, we will publicly credit you for the discovery.
We do not offer monetary rewards at this time.
6. Safe Harbor
We consider security research conducted in good faith and consistent with this policy to be authorized. Specifically:
We will not pursue legal action against you or refer you to law enforcement for research that complies with this policy.
We consider such research authorized under the Computer Fraud and Abuse Act (CFAA) and exempt from the anti-circumvention provisions of the Digital Millennium Copyright Act (DMCA) for this purpose.
If a third party initiates legal action against you for activity conducted in accordance with this policy, we will make it known that your actions were authorized by us.
If you are unsure whether your research is consistent with this policy, contact us at security@impulsehosting.com before proceeding.