Report vulnerabilities responsibly.

Research is authorized under this policy only when it is conducted solely to identify and report a security vulnerability, uses the minimum activity necessary to confirm the issue, avoids harm to people and systems, preserves privacy, complies with applicable law, and follows every boundary in this policy.

You may inspect public responses and client-side resources, submit ordinary requests to public endpoints, and perform low-volume testing reasonably necessary to demonstrate a suspected vulnerability. Use accounts and data you own or are expressly authorized to use. Prefer a minimal proof of concept over extraction, persistence, or repeated exploitation.

Do not perform denial-of-service or resource-exhaustion testing; social engineering, phishing, spam, or physical attacks; password spraying or credential stuffing; malware deployment; persistence or lateral movement; destructive testing; supply-chain attacks; privacy invasion; accessing another person’s account or data; changing or deleting data; exfiltrating data; disrupting service; or testing an out-of-scope system.

If you encounter personal information, credentials, secrets, customer information, or other sensitive data, stop testing immediately. Do not copy, retain, download, transmit, alter, or disclose it beyond the minimum evidence necessary to identify the issue. Tell us what you encountered and securely delete any inadvertently retained data after we confirm it is no longer needed.

When you make a good-faith effort to comply with this policy, Spacetime will consider your research authorized under this policy and will not initiate legal action against you solely for that research. If a third party initiates legal action, we may state that your activity complied with this policy. We cannot authorize activity on third-party systems, bind third parties or law-enforcement authorities, or excuse violations of law.

This is a vulnerability disclosure program, not a bug-bounty program. We do not promise payment, reward, public recognition, employment, services, or other compensation. Do not incur costs in expectation of reimbursement. Any recognition or reward is entirely discretionary and requires separate written approval.

We may update this policy as our public systems and disclosure process change. The version posted here applies prospectively from its effective date. Questions about scope or permitted testing should be sent to security@spacetimesecurity.ai before testing begins.