1. Scope
This policy applies to security vulnerabilities found in:
In-Scope Systems
• ariaeval.io — Marketing website and authentication
• app.ariaeval.io — ARIA Evaluator application
• api.ariaeval.io — ARIA Evaluator API and control plane
• Our open-source repositories on GitHub
Out of Scope
• Third-party services we use (AWS, Stripe, etc.) — report to them directly
• Social engineering attacks against our employees
• Denial of service attacks
• Automated scanning without prior coordination
2. How to Report
Send vulnerability reports to security@ariaeval.io. Include:
Required Information
• Description of the vulnerability and its potential impact
• Steps to reproduce the issue
• Affected URLs, parameters, or endpoints
• Your assessment of severity (Critical / High / Medium / Low)
• Any proof-of-concept code or screenshots
Encryption
For sensitive reports, you may request our PGP key by emailing security@ariaeval.io with the subject line "PGP Key Request".
3. Responsible Disclosure Guidelines
We ask that you follow these guidelines when researching and reporting vulnerabilities:
Do
• Report vulnerabilities promptly after discovery
• Provide sufficient detail for us to reproduce and fix the issue
• Allow reasonable time for us to address the issue before public disclosure (90 days)
• Make a good-faith effort to avoid privacy violations, data destruction, and service disruption
• Only interact with accounts you own or with explicit permission
Do Not
• Access, modify, or delete data belonging to other users
• Perform actions that could degrade service for other users
• Use automated tools to scan our systems without prior coordination
• Publicly disclose the vulnerability before we have addressed it
• Demand financial compensation as a condition for reporting
4. Our Response
When you report a vulnerability, here is what to expect:
Timeline
• Acknowledgment: Within 2 business days
• Initial assessment: Within 5 business days
• Status update: Within 10 business days
• Resolution target: Within 90 days (critical issues prioritised)
Recognition
We maintain a Security Acknowledgments page to recognise individuals who have responsibly reported valid vulnerabilities. If you would like to be acknowledged, please let us know in your report.
5. Safe Harbour
We consider security research conducted in accordance with this policy to be authorised and will not pursue legal action against researchers who follow these guidelines. We will not pursue civil or criminal action, or send notices to Internet Service Providers, against researchers who act in good faith and in compliance with this policy.
6. Qualifying Vulnerabilities
Examples of qualifying vulnerabilities include:
Examples
• Cross-site scripting (XSS)
• Cross-site request forgery (CSRF)
• Server-side request forgery (SSRF)
• SQL injection or NoSQL injection
• Authentication or authorisation bypass
• Remote code execution
• Privilege escalation
• Sensitive data exposure
• Insecure direct object references (IDOR)
Non-Qualifying Issues
• Missing security headers on non-sensitive pages (we already implement comprehensive headers)
• Rate limiting on non-authentication endpoints
• Missing DKIM/DMARC/SPF records
• Clickjacking on pages with no sensitive actions
• Content spoofing / text injection without demonstrable impact
Contact us
If you have questions about this policy, please contact us at security@ariaeval.io.