Report a security problem.

What is in scope

This website at neotericai.app, the pages it serves, and the endpoints it exposes, including the Contact Sales endpoint.

The response headers and content security policy this site serves, where you can demonstrate an impact rather than only a missing directive.

The full list of in-scope domains and services is at [[IN_SCOPE_ASSETS]]. If an asset is not listed there and is not this website, assume it is out of scope and ask before testing.

The Autom desktop application is not downloadable yet, so there is no released build to test. Released builds come into scope when downloads open.

What is out of scope

Anything not operated by Neoteric. That includes third-party language model providers, hosting and edge platforms, and any service a customer connects to Autom. Report those to the organisation that runs them.

Findings that need an already-compromised device, a privileged position on the network, or physical access to a machine.

Missing hardening headers, weak cipher suites, or configuration observations with no demonstrated impact, and scanner output submitted without a working proof of concept.

Social engineering of staff, customers, or suppliers, and anything targeting physical premises.

We already publish the known weakness in our content security policy: the script source allows inline scripts because the framework requires it to hydrate. A report that only restates that is not a new finding. A working injection that uses it is, and we want to see it.

Safe harbour

If you follow this policy, we will treat your research as authorised, we will not bring a claim against you for it, and we will not refer you to law enforcement for it.

If a third party brings a claim about research you carried out in line with this policy, we will make it known that the activity was authorised by us.

This protection covers only systems Neoteric operates, and only research that stays inside the rules below. It cannot waive anyone else's rights, and it cannot override the law of [[GOVERNING_LAW_JURISDICTION]].

The Acceptable Use Policy tells customers not to probe or test the service without a written testing agreement. For the assets listed above, and for research that follows this policy, this page is that authorisation. The two documents need to be brought into line with each other, and that is our job rather than yours.

This section has not yet been reviewed by a lawyer. Until it has, read it as a statement of how we intend to behave rather than as a legal guarantee.

If you are unsure whether something is permitted, ask at [[SECURITY_CONTACT_EMAIL]] before you do it. We would rather answer a question than argue about a test afterwards.

What not to do

Do not run denial of service tests, load tests, or anything else that degrades the service for other people.

Do not social engineer or phish our staff, our customers, or our suppliers.

Do not access, change, or delete data belonging to anyone else. If you can prove access, stop at the proof.

Do not exfiltrate data. Do not download, copy, or keep anything you find. Delete any copy as soon as it is no longer needed to demonstrate the issue, and tell us that you have.

Do not attempt physical access to premises or hardware.

Do not run automated scanning at a volume that affects availability.

Do not make a report conditional on payment. That is extortion, not disclosure, and it ends the safe harbour immediately.

Do not publish before the disclosure terms below have been met.

Disclosure

We prefer coordinated disclosure. Please give us [[DISCLOSURE_WINDOW]] from the date of your report before publishing anything about it.

If we need longer than that, we will tell you why and propose a date rather than going quiet. If we cannot fix an issue, we will say so and agree a position with you.

We will not ask you to stay silent indefinitely.

Recognition

Whether Neoteric offers any reward for a report is at [[BOUNTY_POSITION]]. Nothing on this page should be read as a promise of payment.

We are glad to credit you by name once an issue is fixed, if that is what you want. Tell us how you would like to be named. We will not publish your name without your agreement.

Where acknowledgements will be listed is at [[RECOGNITION_PAGE]]. No such page exists today.

About this policy

This policy is published by [[LEGAL_ENTITY_NAME]]. It does not create a contract between us.

We may update it. The version that applies to your report is the one published on this page at the time you send it.