Vulnerability Disclosure Policy
Airrand LLC values the work of independent security researchers in helping keep our users safe. This policy describes how to report a suspected security vulnerability to us, what you can expect in return, and the rules we ask you to follow while testing.
1. Scope
In scope:
- The Airrand web application and API at
airrand.appandairrand.ai. - Airrand's browser extension and any officially published Airrand client apps.
Out of scope:
- Denial-of-service, load, or spam testing.
- Social engineering or phishing of Airrand staff or users.
- Physical attacks against Airrand offices or infrastructure.
- Vulnerabilities in third-party services we integrate with (Google, Microsoft, Anthropic, OpenAI, and similar) — please report those directly to the provider.
- Any access to, modification of, or disruption to another user's account or data beyond what is strictly necessary to demonstrate a vulnerability using an account you control.
- Automated scanning that generates significant traffic or degrades service for other users.
- Reports generated solely by automated scanners without manual verification of impact (e.g., missing security headers or best-practice advisories with no demonstrated exploit).
2. Ground Rules
When testing, please:
- Only test against accounts and data you own or have explicit permission to test with.
- Stop and report immediately if you encounter another user's data — do not view, copy, modify, or retain it.
- Avoid privacy violations, service degradation, and destruction of data.
- Give us a reasonable opportunity to investigate and remediate an issue before disclosing it publicly.
- Do not exploit a vulnerability beyond what's needed to confirm it exists (for example, stop at proof of access — don't exfiltrate data or pivot further).
3. How to Report
Email [email protected] with "Vulnerability report" in the subject line. Please include:
- A description of the vulnerability and its potential impact.
- Step-by-step instructions to reproduce it, including the URL, endpoint, or feature involved.
- Any proof-of-concept code, request/response data, or screenshots that help us confirm the issue.
- The account(s) you used for testing, so we can distinguish testing traffic from an actual attack.
Please encrypt any sensitive findings or avoid including exploitable details in plaintext where possible, and let us know if you'd like a secure channel for follow-up.
4. What You Can Expect From Us
- We will acknowledge receipt of your report within 3 business days.
- We will investigate and provide an initial assessment of validity and severity as soon as we reasonably can.
- We will keep you informed of progress toward resolution and let you know once a fix has been deployed.
- We will credit researchers who report valid issues (with your permission) once a fix is deployed, if you'd like recognition.
Airrand is a beta product without a paid bug bounty program at this time; we're not able to offer monetary rewards, but we're genuinely grateful for good-faith reports and will say so publicly if you'd like.
5. Safe Harbor
We consider security research conducted consistent with this policy to be authorized. We will not pursue legal action against you for good-faith testing that follows the scope and ground rules above, and we will not report such testing to law enforcement. If a third party initiates legal action related to activities conducted in compliance with this policy, we will make it known that your actions were authorized. This safe harbor does not extend to testing that violates the scope or ground rules described above.
6. Coordinated Disclosure
We ask that you give us a reasonable amount of time to investigate and remediate a reported issue before any public disclosure, and that you coordinate the timing and content of any public write-up with us in advance.
7. Policy Review
This policy is reviewed periodically and may be updated as our security program matures.
8. Contact
Report a vulnerability at [email protected].