Vulnerability Disclosure

How to report

Email security@40tsecureai.com with enough detail for us to reproduce the issue: affected URL or component, steps to reproduce, impact, and any proof-of-concept. If you need to share sensitive material, say so and we will arrange a secure channel.

We aim to acknowledge reports within 3 business days and to keep you updated as we investigate and remediate.

Scope

In scope: the 40T Secure AI web application (40tsecure.ai), its API, and the discovery-scan service.

Out of scope: findings on third-party websites that you scanned with 40T (those belong to their owners), reports from automated scanners with no demonstrated impact, volumetric/denial-of-service testing, social engineering of our staff or vendors, and issues in our sub-processors' own products (please report those to the vendor).

Safe harbor

If you make a good-faith effort to comply with this policy during your research, we will consider your testing authorized, will not pursue legal action against you, and will work with you to understand and resolve the issue quickly. Please avoid privacy violations, data destruction, and service disruption, and only interact with accounts you own or have explicit permission to test.

Please do not

• Access, modify, or delete data that is not yours.
• Run automated scans that degrade the service for others.
• Publicly disclose a vulnerability before we have had a reasonable chance to remediate it.