Security

Reporting a security concern

About 3 minutes to read · Last updated: 22 October 2026

Fast Track Impact helps researchers make a difference with their work. Thousands of people trust us with their accounts, bookings and course progress, and we take that trust seriously. We check and improve our own systems regularly.

If you notice something on our website that looks like a security problem, we would like to hear about it. This page explains how to tell us and what you can expect from us.

Note: this policy is here so that genuine concerns reach us safely. It is not an invitation to test our systems, and we do not run a bug bounty programme.

Your part

If you came across a concern, or looked into one, please:

use only your own account and your own data;
stop as soon as you have enough to show the problem exists;
not use automated scanners or tools that send large numbers of requests;
not attempt denial of service, spam, phishing, social engineering of our team or customers, or any physical access;
give us reasonable time to fix the issue before you tell anyone else about it (see Disclosure below).

Others' data

Our systems are built so that each person sees only their own account, bookings and course progress. If you ever see information that is not yours, that would be unexpected, and we want to know at once. Stop straight away, tell us, and do not keep, copy or share anything you saw.

Deliberately accessing, changing, downloading or deleting anyone else's information is never acceptable and is not covered by this policy. We will treat it as unauthorised access to our systems.

Our part

We are a small team, so we promise what we can reliably deliver.

Confirm we have your report
5 working days
Tell you if we can confirm the issue
10 working days
Fix any confirmed issues
15 days

We will keep you informed if a fix takes longer, and we will treat your report and your contact details as confidential.

Credit

We do not pay for reports, and we do not respond to requests or demands for payment. Reports that come with a payment request will be handled under this policy in the same way as any other, or not at all if they do not meet it.

If you are the first person to tell us about a valid issue we did not already know about, we are happy to thank you personally and, if you would like, to confirm in writing that you reported it.

Scope

Covered

fasttrackimpact.com and its subdomains run by Fast Track Impact.

Not covered

Services we use but do not run. Please report problems with those directly to the company concerned.
Payments (Stripe)
Hosting
Email
Video platforms

We never see or store your full card details: card payments are handled entirely by Stripe.

Exclusions

Some findings come up often but do not put anyone at risk by themselves. We do not treat these as vulnerabilities unless you can show a real way they could be used to cause harm:

missing or "best practice" security headers;
email settings such as SPF, DKIM or DMARC;
clickjacking on pages with no sensitive action;
issues that only affect yourself, such as self-XSS;
software version numbers being visible;
missing rate limits, without a demonstrated attack;
CSV or spreadsheet formula injection;
results from automated scanners that have not been checked by a person;
issues that need an already compromised device or account.

If you find that several of these combine into a genuine risk, we do want to hear about it.

Report

Please use our report form. It takes four short steps and asks for everything we need to look into your report quickly. Before it opens, we ask you to confirm how you came across the concern.

Cannot use the form?

Email security@fasttrackimpact.com with the same details. Please do not include attachments: emails with attachments are refused. One clear report is far more useful to us than an automated scan output.

Disclosure

We follow coordinated disclosure. Please do not publish or share details of an issue until we have fixed it, or until 90 days after your report, whichever comes first. If we need longer, we will explain why and agree a new date with you.

Good faith

If you act in good faith and follow this policy, we will consider what you did to be authorised, we will not take legal action against you, and we will not ask anyone else to. If someone else, such as a supplier, takes action about something you did within this policy, we will make it clear that you followed our rules.

This protection does not apply to anyone who deliberately accesses, keeps or shares other people's information, disrupts our services, or demands payment in return for not publishing a finding. In those cases we will protect the people affected, and that may include reporting the matter to the police and taking legal action.

This policy cannot give permission on behalf of other companies, and it cannot override the law. If you are unsure whether something is allowed, please ask us first at security@fasttrackimpact.com.

About us

Fast Track Impact is the trading name of Methods Innovation, Inc., a non-profit organisation registered in Wyoming, USA, and is delivered by the Institute for Methods Innovation.

Last updated: 22 October 2026