Last updated: September 28, 2026
We welcome reports from anyone who finds a security issue in Import.io. If you act in good faith, we will work with you, thank you, and not come after you.
How to report
Email security@import.io with a description of the issue, the steps to reproduce it and its potential impact. We will acknowledge your report, keep you informed as we investigate and let you know when it is fixed.
Safe harbour
If you make a good-faith effort to follow this policy, we will consider your research authorised, we will not take legal action against you, and we will not ask anyone else to. If a third party takes action against you for research done under this policy, we will make it known that you acted with our authorisation.
Please
- only access as much data as you need to show the issue, and don’t keep or share it;
- avoid degrading the Service for other users, and don’t run denial-of-service tests;
- don’t use social engineering or physical attacks against our people or offices; and
- give us reasonable time to fix the issue before you disclose it publicly.
Scope
Import.io websites, applications, APIs and the MCP server are in scope. Third-party services we use are not; please report issues in them to their owners.
Recognition
We don’t run a formal bug bounty programme, but we may offer a reward for critical findings — such as remote code execution, authentication bypass or significant data exposure — case by case. With your permission, we are happy to credit you publicly.