The Foundation of Change is a 501(c)(3) nonprofit organization, EIN 33-5003265.501(c)(3) nonprofit EIN 33-5003265

Verify a certificate
501(c)(3) Nonprofit  ·  EIN: 33-5003265thefoundationofchange.org
Ethics & Accountability

Security and Responsible Disclosure

Courts and supervising officers rely on our certificates. If you find a weakness in our systems, we want to hear about it, and we will work with you in good faith to fix it.

What to report

We especially want to know about:

  • Ways around verification: any way to earn hours, complete coursework or obtain a certificate without doing the work.
  • Certificate integrity: any way to create, alter or falsely verify a certificate or activity report.
  • Access to other people's information: any way to view or change another participant's records.
  • Other security problems in thefoundationofchange.org, the participant dashboard, the verification portal or the documents it produces.

How to report

Email info@thefoundationofchange.org with "Security report" in the subject line. Please include:

  • What you found and where (the page or address).
  • The steps to reproduce it.
  • What someone could do with it.
  • How to reach you, and whether you would like to be credited.

Please do not include another person's personal information in your report.

Our commitments

  • We will acknowledge your report within 3 business days.
  • We will tell you what we found within 10 business days, and keep you updated until it is resolved.
  • We will fix confirmed problems as quickly as their seriousness requires.
  • With your permission, we will credit you on our Integrity Updates page once the fix is in place.

We are a small nonprofit and do not offer payment for reports.

Good faith research

If you make a good faith effort to follow this policy, we will not pursue or support legal action against you for your research, and we will treat your report as help rather than an attack. Good faith means you:

  • Use only your own account or a test account, and never use someone else's account or data.
  • Access no more information than you need to show the problem, and do not keep, share or change it.
  • Do not use a weakness to obtain hours or a certificate you would present to a court or agency.
  • Avoid degrading the service for anyone else, and stop if you are unsure.
  • Give us a reasonable time to fix the problem before telling anyone else.

Out of scope

  • Denial of service, load testing or automated scanning that affects other users.
  • Social engineering, phishing or physical attempts against our staff or partners.
  • Third-party services we use (such as payment processing), which have their own reporting programs.

For how the program works, see Transparency and Ethics. A machine-readable version of this contact is at /.well-known/security.txt.