Vulnerability Disclosure Policy

1. Introduction

PureTensor Inc values the security community and believes that responsible disclosure of security vulnerabilities helps us ensure the security and privacy of all our users. We are committed to working with security researchers who identify vulnerabilities in our systems through coordinated disclosure.

This policy describes how to report vulnerabilities to us, what you can expect from PureTensor in response, and what we expect from you as a researcher. It is based on the CISA Coordinated Vulnerability Disclosure framework.

2. Scope

3. Reporting a Vulnerability

What to Include in Your Report

• A clear description of the vulnerability and its potential impact
• Step-by-step reproduction instructions sufficient for our team to verify the issue
• Affected URLs, parameters, endpoints, or components
• Screenshots, screen recordings, or proof-of-concept code (if applicable)
• Your assessment of severity (Critical / High / Medium / Low)
• Your name and contact information (if you wish to be acknowledged)

Encryption

If you need to encrypt sensitive vulnerability details, please contact us first to request our PGP public key. We recommend encrypting any report that includes working exploit code, credentials, or sensitive data.

4. What We Promise

When you report a vulnerability in accordance with this policy, PureTensor commits to the following:

1. Acknowledgment: We will acknowledge receipt of your report within 3 business days.
2. Assessment: We will provide an initial assessment of the reported vulnerability within 10 business days.
3. Updates: We will keep you informed of our progress at least every 14 days until the issue is resolved.
4. Resolution: We aim to resolve critical vulnerabilities within 30 days and other vulnerabilities within 90 days of confirmed receipt.
5. Recognition: With your permission, we will publicly acknowledge your contribution in our security acknowledgments.
6. No Legal Action: We will not pursue legal action against researchers who discover and report vulnerabilities in accordance with this policy.

5. Safe Harbor

6. Researcher Obligations

To qualify for safe harbor protection, researchers must adhere to the following guidelines:

1. Good Faith: Act in good faith at all times. Avoid privacy violations, data destruction, and service disruption.
2. Minimize Harm: Make every effort to avoid impacting service availability or data integrity. Do not degrade the experience for other users.
3. Do Not Exfiltrate: Do not access, modify, or exfiltrate data beyond what is minimally necessary to demonstrate the vulnerability. If you encounter personal data, stop testing immediately.
4. Confidentiality: Do not publicly disclose the vulnerability until PureTensor has had a reasonable opportunity to remediate (minimum 90 days from confirmed receipt), or until we jointly agree on a disclosure timeline.
5. No Extortion: Do not demand payment or threaten disclosure as leverage. This policy does not constitute a bug bounty program.
6. Scope: Only test against systems listed in the "In Scope" section above. Do not test against out-of-scope systems.
7. Notification: If you inadvertently access personal data or cause unintended impact, stop testing immediately and notify us.

7. Qualifying Vulnerabilities

The following are examples of vulnerability types that are within the scope of this policy. This is not an exhaustive list:

• Cross-site scripting (XSS) — stored, reflected, or DOM-based
• Cross-site request forgery (CSRF)
• Server-side request forgery (SSRF)
• SQL injection or other injection vulnerabilities (command injection, LDAP injection, etc.)
• Authentication or authorization flaws (privilege escalation, broken access control)
• Sensitive data exposure (unencrypted secrets, leaked credentials, PII disclosure)
• Remote code execution (RCE)
• Insecure direct object references (IDOR)
• Security misconfigurations with demonstrable impact
• Path traversal or local file inclusion
• Broken cryptographic implementations

8. Non-Qualifying Issues

The following issues generally do not qualify under this policy, unless you can demonstrate a concrete, exploitable impact:

• Missing security headers (e.g., X-Frame-Options, HSTS) that do not lead to a demonstrable attack
• Clickjacking on pages with no state-changing or sensitive actions
• Self-XSS (attacks that require the victim to paste code into their own browser console)
• Missing rate limiting without a demonstrable abuse scenario
• Software version disclosure without a known, exploitable vulnerability for that version
• Content spoofing or text injection without demonstrable impact
• Reports generated solely by automated scanning tools without manual verification of exploitability
• Theoretical vulnerabilities without proof of concept
• Issues in third-party dependencies that do not affect PureTensor's deployment
• Reports of insecure SSL/TLS cipher suites or configurations that are mitigated by other controls

9. Acknowledgments

We maintain a hall of fame for security researchers who have responsibly disclosed valid vulnerabilities to PureTensor. If you would like to be publicly acknowledged for your contribution, please indicate this preference in your report.

Acknowledgment typically includes your name (or handle) and, optionally, a link to your website or professional profile. We will seek your approval before publishing any acknowledgment.