Report a security issue.

When you report an issue under this policy, you can expect us to:

• Acknowledge your report within 5 business days.
• Work with you to understand and validate it, and share an initial assessment within 15 business days.
• Keep you informed as we work on a fix, within our operational constraints.
• Credit you publicly, if you would like it, once the issue is fixed.
• Extend the safe harbor below to research conducted under this policy.

What we ask of you

In return, we ask that you:

• Report anything you find promptly, through the address above.
• Avoid violating anyone's privacy, degrading our services, or destroying data.
• Limit yourself to the minimum access needed to demonstrate the issue, and stop immediately and tell us if you encounter personal data.
• Interact only with accounts you own or have explicit permission to test.
• Test only in-scope systems, and respect what is out of scope.
• Give us 90 days from your first report to fix the issue before disclosing it publicly, and talk to us if you need that to move.
• Not use the issue for extortion.

When you conduct security research in accordance with this policy, we consider that research to be:

• Authorized in view of any applicable anti-hacking laws, and we will not initiate or support legal action, or a complaint to law enforcement, against you for accidental, good-faith violations of this policy.
• Authorized in view of relevant anti-circumvention laws, and we will not bring a claim against you for circumvention of technology controls.
• Exempt from restrictions in our terms of use that would interfere with conducting security research, which are waived on a limited basis for that purpose.
• Lawful, helpful, and conducted in good faith.

You are expected to comply with all applicable laws. If a third party initiates legal action against you and you have complied with this policy, we will take steps to make known that your actions were conducted in compliance with it. This safe harbor applies only to legal claims under Aletarch Inc's control; it cannot bind anyone else. It does not apply to research that falls outside this policy's scope or conduct rules, or that is not in good faith.

If you are unsure whether something you want to try is consistent with this policy, ask us first, at the address above, before going any further.

In scope:

• aletarch.com
• eidren.ai, including the authentication and preview hosts that we operate, and eidren.aletarch.com, which redirects to it
• api.aletarch.com
• Any other host under aletarch.com or eidren.ai that Aletarch operates

Our configuration and content on these hosts is in scope; the platforms of the providers that serve them are not.

Out of scope: services operated by third parties, including the infrastructure, hosting, authentication, payment, and AI-model providers we build on, which have their own disclosure programs; social engineering of Aletarch people, contractors, or vendors; physical access to property or equipment; denial-of-service and volumetric or load testing; automated scanning that generates significant traffic; and any testing that would access data belonging to someone else.

Eidren accounts

Eidren admits a limited number of new accounts. Test only with an account you hold legitimately, only against your own data, and do not direct the agent at systems you are not authorized to test. The terms that govern your Eidren account apply alongside this policy; where the two conflict for good-faith research, this policy prevails.

Bounties

We do not offer bounties.