Responsible Disclosure Policy (RFC 9116)
Coordinated vulnerability disclosure guidelines, PGP keys, response SLAs, and legal safe harbor guarantee.
1. Coordinated Vulnerability Disclosure Commitment
At Cyber Security House, security is our primary mission. We value the vital role independent security researchers play in identifying vulnerabilities. We are committed to working with the global security community to investigate and remediate reported flaws in a coordinated and transparent manner.
Our security policies comply with RFC 9116 and our machine-readable policy is published at /.well-known/security.txt.
2. In-Scope & Out-of-Scope Targets
In-Scope: *.cybersecurityhouse.com, production API endpoints (/api/v1/*), and official client collector binaries.Strictly Out-of-Scope: Denial of Service (DoS/DDoS) attacks, automated high-rate volumetric scanners, physical security attacks against office facilities or datacenters, social engineering or phishing targeting employees or contractors, and accessing or modifying data belonging to other customers.3. Reporting Guidelines & Contact
Please submit your findings to [email protected]. Please include a clear description of the vulnerability, step-by-step reproduction instructions, a proof-of-concept (PoC) where applicable, and any remediation recommendations.
Please encrypt sensitive reports using our PGP public key available at cybersecurityhouse.com/pgp-key.asc.
4. Safe Harbor Legal Guarantee
ARYA AI TECHNOLOGY LTD (Company No. 17372232) provides a strict legal safe harbor for good-faith security researchers. If you conduct vulnerability research in accordance with this policy:
We will consider your research authorized and will not initiate legal action against you for accidental or incidental violations.
We will not pursue claims under the UK Computer Misuse Act 1990 or international anti-hacking statutes.
We commit to working with you to understand and resolve the issue quickly.
5. Response SLA & Recognition
We commit to the following response timeline: Initial acknowledgement within 24 to 48 business hours; preliminary assessment within 3 business days; regular progress updates every 5 business days until resolution.
Researchers who submit verified, novel security vulnerabilities are acknowledged in our Hall of Fame and are eligible for our discretionary security bounty rewards.