Security & Vulnerability Disclosure

Scope

This policy covers the services Notmax, LLC operates itself. Third-party platforms we rely on run their own programmes and should be reported to them directly.

• The Unifyed web application and its API

How to report

Email contact@unifyed.ai with a description of the issue, the steps needed to reproduce it, and what an attacker could actually achieve with it. One issue per report. Include the date and time of your testing so we can match it against our logs.

We acknowledge every report within five business days and tell you what we intend to do about it. Please do not use public channels, social media or our customer support inbox to disclose an unfixed issue.

Safe harbour

If you follow this policy, act in good faith and stay within the limits below, we will treat your testing as authorised and will not pursue legal action over it. If a third party brings a claim about activity that complied with this policy, we will make that authorisation known.

Never authorised

The following fall outside this policy. They are not research, and safe harbour does not extend to them.

• Denial of service, load testing, or anything that degrades the service for users

No reward

We do not run a bug bounty. We pay no reward, bounty, fee, consulting engagement or compensation of any kind for a vulnerability report, whatever its severity. This is a settled position, not an opening offer.

We will credit you by name once an issue is fixed, if you would like that. A report accompanied by a demand for payment, or by a deadline attached to a threat of publication or of contacting our users, is treated as an extortion attempt rather than a disclosure, and is handled accordingly, including by referral to law enforcement.

Coordinated disclosure

We ask that you give us 90 days from your report before publishing anything about it. Most issues are fixed well within that window, and we are glad to agree a shorter timeline once a fix is live. We will tell you when it ships.