Vulnerability Disclosure Policy

PureTensor, Inc. values the security community and believes that responsible disclosure of security vulnerabilities helps us ensure the security and privacy of all our users.

Scope

In Scope: puretensor.ai and its subdomains operated by PureTensor, Inc. (including argus.puretensor.ai and intel.puretensor.ai), endpaper.ink, puretensor.xyz, and software published by PureTensor, Inc.

Out of Scope: The underlying hosting, CDN, email, form and payment services we use (such as Amazon Web Services, Cloudflare, Google, Formspree and Stripe) and other third-party services; systems operated by our sister company PureTensor Ltd, which has its own policy at puretensor.co.uk/vdp; physical security testing; social engineering; denial of service attacks; and automated scanning that degrades availability.

Reporting a Vulnerability

Contact: [email protected] (or [email protected] with "Security Vulnerability Report" in the subject line). This address is also published at puretensor.ai/.well-known/security.txt.

Include: a clear description of the vulnerability, step-by-step reproduction instructions, affected URLs or components, severity assessment, and your contact information.

What We Promise

We aim to acknowledge receipt within 3 business days, provide an initial assessment within 10 business days, and update you at least every 14 days. Our target is to resolve critical vulnerabilities within 30 days and others within 90 days. We will not pursue legal action against researchers who comply with this policy.

Safe Harbor

Security research conducted consistent with this policy is authorized by PureTensor, Inc. for the purposes of the Computer Fraud and Abuse Act and similar laws (including the UK Computer Misuse Act 1990), to the extent we are entitled to authorize access to the systems in scope. We will not bring a claim under the DMCA anti-circumvention provisions or our Terms of Service against compliant research. We cannot authorize testing of systems operated by third parties. We will not initiate legal action against compliant researchers.

Researcher Obligations

Act in good faith. Minimize harm. Do not exfiltrate data. Maintain confidentiality for 90 days. Do not demand payment. Only test in-scope systems. Notify us of unintended impacts.

Qualifying Vulnerabilities

XSS, CSRF, SSRF, SQL injection, authentication flaws, sensitive data exposure, RCE, IDOR, security misconfigurations, path traversal, and broken cryptography.

Contact

PureTensor, Inc., a Delaware corporation headquartered in Santa Clara, California, United States. Email: [email protected]