Syntropy AI Global Inc. values the work of independent security researchers in helping keep our software secure. This policy sets out how to report a vulnerability, the rules for good-faith research, and our safe harbor commitment.
1. How to Report a Vulnerability (security@syntropyaiglobal.com)
Send suspected security vulnerabilities to security@syntropyaiglobal.com. To help us triage quickly, please include:
- The affected domain, API endpoint, or application and version (web, desktop, mobile, or display device).
- Step-by-step instructions, request and response samples, or proof-of-concept code to reproduce the issue.
- Your assessment of the potential impact (for example, cross-customer data access, XSS, or authentication bypass).
2. Scope & Good-Faith Rules
When researching under this policy, you must:
- Not access, view, modify, download, or delete data belonging to any Syntropy customer or store.
- Not run denial-of-service attacks, automated credential stuffing, or physical intrusion against our premises or customer locations.
- Not conduct social engineering or phishing against our personnel or customers.
- Allow us a reasonable remediation period of up to 90 days before disclosing the issue publicly.
3. Our Response Timeline & Safe Harbor
Response: We aim to acknowledge your report within 2 business days and send a triage update within 5 business days.
Safe harbor: If you research in good faith and in line with this policy, Syntropy AI Global Inc. considers your research authorized and will not initiate legal action against you for it.
Questions about this responsible disclosure policy? Contact us at get@syntropyaiglobal.com.