Security & Abuse Policy

1. Security reports

Report a suspected vulnerability in VibeSIEM Scan to [SECURITY_CONTACT_EMAIL]. Include the affected URL or component, impact, reproduction steps, and a safe way to contact you. Do not include secrets in the first message. We will acknowledge and prioritize reports according to risk when operational processes are finalized.

2. Safe-harbor intent

We intend to support good-faith research that is authorized, limited to our own systems, designed to avoid harm and privacy violations, and reported promptly. Final safe-harbor language requires counsel review. This policy cannot authorize testing of customer targets, third-party providers, or infrastructure we do not control.

3. Research boundaries

• Do not access, retain, alter, or disclose another person’s data.
• Do not use denial-of-service, social engineering, physical attacks, credential attacks, malware, persistence, or automated high-volume scanning.
• Stop after demonstrating the minimum evidence required.
• Do not demand payment, threaten disclosure, or publish before coordinated remediation.
• Comply with law and provider policies.

4. Abuse reports

Report suspected unauthorized scanning, unsafe runner behavior, policy violations, or a scanner-origin complaint to [ABUSE_CONTACT_EMAIL]. Include the scan identifier from the user agent, timestamp with time zone, source IP, target hostname, relevant request excerpts, and impact. Redact credentials and unrelated personal data.

5. Response actions

We may revoke pairing, disable a check or ruleset, require a minimum runner version, suspend an account, preserve relevant audit records, contact affected parties, or cooperate with lawful requests. We will minimize retained evidence and avoid sharing vulnerability details beyond those who need them.

6. No bug bounty promise

This draft does not create a bug bounty or promise payment. Any reward must be agreed separately in writing before relying on it.