AI Safety & Trust and Safety
Vulnerability Disclosure Policy
Version:2.0
Effective:July 4, 2026
Updated:July 4, 2026
Review:January 4, 2027
Purpose
Establishes a safe process for researchers to report security vulnerabilities.
Scope
All WEBSPACEAI-owned domains, APIs, and applications.
Definitions
Vulnerability.
Policy Statements
Good-faith testing authorized within scope. Reports to vuln@webspaceai.in privately; 90-day remediation window before public disclosure. No legal action against good-faith researchers acting within scope.
Responsibilities
Security triages and remediates; CISO owns disclosure timelines.
Compliance Requirements
Critical vulnerabilities remediated within 15 days; high within 30 days.
Enforcement
Out-of-scope or malicious testing may result in legal action.
Reporting Process
vuln@webspaceai.in (PGP available)
Exceptions Process
Scope exceptions require prior written Security authorization.
Review Process
Annual.
Contact Information
End of document — Doc 14 · v2.0