Security and trust
Vulnerability disclosure policy
We welcome reports from security researchers. This policy says how to report a vulnerability in our products or this website, and what we commit to in return.
How to report
Email security@neuralinverse.com. Please do not report vulnerabilities in public issues, forums or social media.
What to include
- a description of the vulnerability and where it is;
- steps to reproduce it, or a proof of concept;
- the affected product and version, or the URL;
- its impact: what an attacker could achieve.
What happens next
| Stage | Our commitment |
|---|---|
| Acknowledgement | Within 72 hours |
| Initial triage | Within 7 days |
| Fix | Within 30 days for critical issues and 60 days for high-severity issues |
| Public disclosure | Coordinated with you, normally 90 days from the report |
We will keep you informed of progress. If you need more time before disclosure, tell us.
Scope
Neural Inverse products in supported versions, and this website. We are most interested in:
- authentication bypass or privilege escalation;
- token or session leakage or forgery;
- injection (SQL, command), server-side request forgery;
- cryptographic weaknesses in token generation or password hashing;
- OIDC, OAuth 2.0 or SAML flaws that lead to unauthorised access;
- disclosure of credentials, personal data or keys;
- bypass of agent authorisation, policy, data loss prevention or code review gates;
- sandbox escape or access to another organisation's data;
- tampering with the audit log or bypassing its hash chain.
Out of scope
- social engineering or phishing of our staff or customers;
- denial of service, including volumetric testing;
- vulnerabilities in dependencies without a demonstrated exploit path;
- issues that need physical access to infrastructure;
- missing rate limits or security headers without a demonstrated security impact;
- automated scanner output without manual verification.
Rules of engagement
- Test only against your own accounts and data, or a deployment you run yourself.
- Do not access, change or delete other people's data. If you reach it by accident, stop, do not keep it, and tell us.
- Do not degrade the service for others.
- Give us reasonable time to fix the issue before you disclose it.
Safe harbour
If you act in good faith and within this policy, we will consider your research authorised, will not pursue legal action against you for it, and will not ask law enforcement to do so. If a third party takes action against you for research within this policy, we will make it known that your work was authorised.
Recognition
We do not run a paid bug bounty programme. With your permission, we credit researchers in the release notes of the fix.