Meridian Civic Systems

Program overview

Meridian Civic Systems Authority is a joint agency chartered in 2019 and owned by the nineteen municipalities it serves. We run the software those members share: permitting and licensing, transit fare accounts, field inspections, open data, and the identity service they all sit on.

This is a vulnerability disclosure policy. It does not pay. There is no bounty appropriation, and creating one would take a budget action carried in nineteen council chambers. What we offer instead is a triage team that answers within a working day, a written account of what we changed, credit under the name you choose, and for serious findings a signed letter from the executive director. Reporters tell us the letter is the part they wanted.

Testing rules and expectations

Register your own accounts. File practice applications against the training parcel at permits.meridiancivic.example/training, prefix every free-text field with VDP-TEST, and never file against a real address or into a queue a clerk has to empty.

Stay under ten requests per second and stop as soon as a finding is proved. If you reach records belonging to a resident, an applicant or an employee, capture the minimum that shows the exposure and stop. Do not enumerate, and do not attach the records: describe them and we will pull them ourselves.

Systems you may never test

Two categories sit outside this policy and outside every protection in it.

Election systems. Voter registration, ballot preparation, tabulation, results reporting, and any system supporting them at a member county board of elections. The Authority neither runs them nor holds the standing to authorise testing.

Emergency dispatch. Emergency call handling, computer-aided dispatch, responder paging, and the interfaces between them. Interference risks a delayed response to a real emergency, and the risk is not ours to accept on a resident's behalf.

Neither is a scope violation to be argued afterwards: testing either is unauthorised access, and this page will not help you.

Proving write access

If you find a way to write, do not prove it by causing damage. Prove it with the smallest change that can be attributed to you and undone in the same minute.

• One or two punctuation characters. Delete a full stop, add a comma. Nothing longer, nothing visible, no payload, no changed number or amount.
• Only on a record you created yourself. Never another user's record, never site content, never anything the public can see.
• Revert within sixty seconds, in the same run, without being asked.
• Capture four states: before, after the change, after the revert, and an independent re-read confirming the revert held.
• If it cannot be reverted, do not change it. Report the write primitive and stop. A row count and a column list already prove database access.

Every request must carry headers that let us separate your traffic from a real attack in our logs:

X-Bug-Bounty:        meridian-civic
X-Research-Account:  <the account you submit the report under>
X-Authorisation-Ref: <engagement or report reference>
X-Request-Id:        <unique per request>
User-Agent:          sentinel-research/<handle> (+<this page>)

scripts/proof_of_write.py performs exactly this sequence, refuses any host outside the scope above, refuses a diff longer than two characters, always attempts the revert, and writes a timestamped evidence file. Run it without --execute first, then attach the evidence to your report.

Safe harbor

Read this before you start; it is the section we have revised most.

Authorisation

The Authority authorises good-faith security research conducted under this policy against the assets listed in scope. It gives that authorisation on its own behalf and on behalf of each of its nineteen member municipalities, whose counsel approved this wording in August 2026.

Research inside this policy is authorised access. It is not unauthorised access, it does not exceed authorised access, and it does not breach the terms of service of the systems above. Where an Authority contract or acceptable use policy would otherwise forbid it, this policy governs for the duration of your research.

No reporter who stays inside this policy will face civil or criminal proceedings brought or supported by the Authority, and we will not ask any prosecutor to open one. If a third party begins an action arising from authorised research, we will confirm the authorisation in writing, on letterhead, to that party and to any court that asks.

Acting in good faith

You are in good faith when you work only on in-scope assets, use accounts you registered, stop at proof instead of collecting, leave public services running on time, and come to us before you go anywhere else.

If an agency contacts you

Municipal networks are monitored and alerts reach investigators. In July 2025 a reporter was questioned by a member police department over testing this policy expressly permitted, which is why this paragraph exists.

Contact us immediately. Tell us who approached you and what they asked, and send the hours you were testing so we can line them up against our logs. You may state that you are conducting authorised research under this policy and refer the officer or the agency to us. We confirm your authorisation in writing to them within one business day, and have done so four times. Keep your notes, logs and captures. Do not withdraw your submission.

What ends this authorisation

Testing a prohibited system. Retaining resident, applicant or employee records beyond minimum proof. Altering or deleting a government record. Disrupting a public service. Using a finding for personal gain. Asking for money in exchange for silence. Publishing before the coordinated window closes. Where authorisation ends, we say so in writing and name the conduct that ended it.

Public records

Your submission is a record held by a public agency and may be subject to disclosure under public records law. We assert the exemptions available for security information and for a reporter's identifying details, and have prevailed each time. We will notify you before any release we are compelled to make. We cannot promise confidentiality that is not ours to give, so if anonymity matters to you, submit under a pseudonym and tell us nothing that identifies you.

Reward decisions

With no money to allocate, what gets decided is severity, and severity sets priority. We start at CVSS v3.1 and adjust for civic consequence: a resident's home address beside their permit history is treated more seriously than the base score suggests, as is anything that could delay an occupancy certificate or hold a rider at a fare gate. Duplicates are settled by receipt timestamp, and both reporters are credited.

Disclosure policy

Coordinated, ninety days from acknowledgement, with one extension of thirty days where a fix depends on a vendor release or a council-approved change window. We tell you which of the two applies and name the date.

After the window, publish. Redact personal information, internal hostnames, parcel identifiers and case numbers. Send the draft five business days ahead; we read it for redaction only.

Report quality

• The asset, URL, method and parameter written out, not described in prose.
• Numbered steps from account registration, followable by a reviewer new to the system.
• The handles and VDP-TEST markers you used, so we can find and remove your test data.
• Impact in civic terms: which residents, which municipality, which service.
• The date, the time window and the source address you tested from.
• Whether you want to be named or anonymous, and the exact spelling to use.