Skip to main content

Security Policy

Last Updated: October 11, 2026

Reporting a Vulnerability

If you discover a security vulnerability in Baseline, please email security@baselinecoach.app with:

  • •Description of the vulnerability
  • •Steps to reproduce
  • •Potential impact
  • •Your contact information

Responsible Disclosure

Please do NOT publicly disclose a vulnerability until we have had a reasonable opportunity to address it. We commit to working with you in good faith to understand and resolve the issue quickly.

Response Timeline

We aim to meet the following timeline for all reports:

  • •Initial response: within 24 hours
  • •Status updates: every 7 days
  • •Public disclosure: after a fix is deployed, or 90 days from the report, whichever is sooner

Safe Harbor

We will not pursue legal action against researchers who act in good faith under this policy: who avoid privacy violations, data destruction and service disruption, only access data needed to demonstrate the issue (using your own test accounts wherever possible), and give us reasonable time to fix it before disclosure.

Scope

In scope: baselinecoach.app and its subdomains, and the Baseline API. Out of scope:

  • •Denial-of-service or load testing, including rate-limit volume testing
  • •Social engineering or phishing of Baseline staff or users
  • •Physical attacks
  • •Vulnerabilities in third-party services we use (Stripe, Cloudflare, Resend, Google, Vercel, DigitalOcean, hCaptcha); please report those to the vendor
  • •Findings from automated scanners without a demonstrated impact

Security Measures in Place

Baseline implements the following safeguards across the platform:

  • •HTTPS everywhere, with HSTS, a strict Content Security Policy and secure headers
  • •Sign-in handled by our own service: passwords are stored only as argon2id hashes, sessions are server-side and revocable, and every API request is authorized on the server, with ownership checks on all user data
  • •hCaptcha-protected sign-up with a server-side password policy
  • •Per-IP and per-endpoint rate limiting
  • •Stripe webhooks are signature-verified and processed exactly once; card data never touches our servers
  • •Uploaded videos are deleted from our servers and AI provider storage once analysis finishes
  • •Text you type (upload notes, Ask Coach questions) is treated as data, never as instructions, when sent to the AI
  • •Account bans take effect across all servers immediately
  • •A persistent audit log of administrative actions

Disclaimer

Baseline is a tennis coaching analytics platform. While we take security seriously, users should not assume complete confidentiality of video submissions.

Contact

security@baselinecoach.app