Security at Impulse Hosting

Vulnerability Disclosure Policy · Last updated: October 29, 2026

Impulse Hosting is operated by Practical Objects, LLC (d/b/a Impulse Hosting), Dallas, Texas. We welcome reports from security researchers who find vulnerabilities in our systems, and we work with them to fix issues quickly. This policy explains how to report a vulnerability, what is in scope, and how we protect researchers who act in good faith.

1. Security Contact

Security lead: Marlin Todd

Report vulnerabilities to: security@impulsehosting.com

Machine-readable contact information is published at /.well-known/security.txt (RFC 9116).

2. Scope

The following systems are in scope:

• impulsehosting.com and its subdomains operated by Impulse Hosting
• The Impulse Hosting customer portal and control panel
• ImpulseDB, ImpulseAuth, and ImpulseDrive (beta)
• Services operated by Impulse Hosting on impulse.host

The following are out of scope:

• Websites, applications, and content hosted by our customers
• Denial-of-service or volumetric/load testing
• Social engineering or phishing of our staff, contractors, or customers
• Physical attacks against offices, data centers, or equipment
• Spam or sending unsolicited messages
• Third-party services and platforms not operated by Impulse Hosting
• Findings from automated scanners without a working proof of concept
• Missing best-practice headers or configurations without a demonstrated security impact

3. Rules of Engagement

• Test only against accounts and resources you own or have explicit permission to use.
• Do not access, modify, or exfiltrate data beyond the minimum needed to demonstrate the issue.
• Do not violate the privacy of our customers or staff, or degrade our services.
• If you access customer data or another user’s information, stop immediately and report it to us.
• Give us a reasonable time to fix the issue before any public disclosure. Our default coordinated disclosure window is 90 days from your report.

4. What to Include in a Report

• The affected system, URL, or component
• A description of the vulnerability and its potential impact
• Step-by-step instructions to reproduce it, with a proof of concept where possible
• Any relevant screenshots, requests/responses, or logs
• How you would like to be credited, if at all

5. Our Commitments

• We will acknowledge your report within 3 business days.
• We will keep you informed as we investigate and fix the issue.
• With your permission, we will publicly credit you for the discovery.

We do not offer monetary rewards at this time.

6. Safe Harbor

We consider security research conducted in good faith and consistent with this policy to be authorized. Specifically:

• We will not pursue legal action against you or refer you to law enforcement for research that complies with this policy.
• We consider such research authorized under the Computer Fraud and Abuse Act (CFAA) and exempt from the anti-circumvention provisions of the Digital Millennium Copyright Act (DMCA) for this purpose.
• If a third party initiates legal action against you for activity conducted in accordance with this policy, we will make it known that your actions were authorized by us.

If you are unsure whether your research is consistent with this policy, contact us at security@impulsehosting.com before proceeding.