Vulnerability Disclosure Policy

Purpose

Corenth Technologies LLC recognizes that responsible vulnerability reporting can help identify and address security weaknesses before they cause harm.

This Vulnerability Disclosure Policy establishes a process through which security researchers, customers, users, and members of the public may report suspected vulnerabilities involving Corenth Technologies systems or services.

The policy also defines authorized testing boundaries, prohibited activity, reporting expectations, coordinated disclosure principles, and the current limitations of the Corenth Technologies vulnerability-management process.

Authorization and Safe Harbor

Security research is considered authorized under this policy only when it:

• Involves a Corenth Technologies asset that has been explicitly identified as in scope.
• Is conducted solely for good-faith testing, investigation, reporting, or correction of a suspected security vulnerability.
• Is designed to avoid harm to people, customers, systems, data, service providers, and the public.
• Complies with every limitation and requirement stated in this policy.
• Uses information obtained through the research primarily to improve security or safety.

Corenth Technologies will not initiate legal action solely because a researcher conducted good-faith security research that fully complied with this policy, subject to the limitations stated below and applicable law.

When uncertainty exists about whether a proposed activity is authorized, request written clarification before proceeding.

Testing Scope

Only systems and assets expressly identified by Corenth Technologies as in scope are authorized for deliberate security testing.

Any published in-scope asset list may identify:

• Authorized production domains and subdomains.
• Authorized applications and API endpoints.
• Permitted testing methods.
• Rate limits and automation restrictions.
• Excluded systems, data, and providers.
• Test-account requirements.
• Any temporary or environment-specific restrictions.

Rules of Engagement

When testing is expressly authorized, researchers must:

• Testing an explicitly in-scope Corenth Technologies asset using an account and information you control.
• Performing limited, non-destructive verification of a suspected security weakness.
• Reviewing publicly accessible pages, requests, responses, and client-side application behavior.
• Testing authorization boundaries without accessing another user’s account or information.
• Submitting a clear report with reproduction steps, technical impact, and recommended remediation.
• Use only accounts, organizations, records, documents, payment methods, and information they own or are expressly authorized to use.
• Limit testing to the minimum activity reasonably necessary to confirm the vulnerability.
• Stop testing immediately when unauthorized personal, confidential, payment, authentication, customer, or proprietary information is encountered.
• Avoid creating persistence, changing production data, or weakening security controls.
• Report the vulnerability promptly after confirming it.
• Preserve confidentiality while Corenth Technologies reviews and addresses the issue.

Prohibited Testing

The following activities are not authorized under this policy:

• Denial-of-service, distributed denial-of-service, resource-exhaustion, or load testing.
• Social engineering, phishing, impersonation, pretexting, or contacting employees, contractors, customers, or service providers deceptively.
• Physical intrusion, office access, device theft, surveillance, or attempts to bypass physical security.
• Malware, ransomware, destructive code, persistence mechanisms, backdoors, or command-and-control activity.
• Credential stuffing, password spraying, brute force, broad account enumeration, or use of stolen credentials.
• Accessing, changing, deleting, downloading, exporting, or retaining another user’s information.
• Large-scale automated scanning that could degrade performance or trigger provider restrictions.
• Testing third-party infrastructure without that provider’s separate written authorization.
• Extortion, threats, demands for payment, or withholding vulnerability information to obtain compensation.

Researchers may not intentionally exploit a vulnerability beyond the minimum necessary to demonstrate its existence and potential impact.

Third-Party Services and Infrastructure

Corenth Technologies relies or may rely on third-party providers for infrastructure, authentication, hosting, payments, communications, databases, AI services, analytics, and integrations.

This policy does not grant authorization to test systems owned, controlled, operated, or hosted by a third party. Examples include:

• Supabase infrastructure and provider-controlled services.
• Stripe checkout, payment, and provider systems.
• AI model and API provider infrastructure.
• Hosting, domain, email, communications, and DNS providers.
• Customer-owned systems and external services not operated by Corenth.
• Social-media and external account platforms.

Testing a third-party service requires separate authorization from that provider and must comply with its applicable vulnerability-disclosure policy.

Sensitive Information

Researchers must avoid accessing, collecting, downloading, copying, changing, retaining, or disclosing information that is not necessary to demonstrate a vulnerability.

Sensitive information may include:

• Passwords, credentials, session tokens, and API keys.
• Customer, employee, contractor, or applicant information.
• Payment, billing, banking, or transaction information.
• Private communications and uploaded documents.
• Proprietary source code, prompts, workflows, or business records.
• Authentication, recovery, security, and audit information.
• Information belonging to another organization or user.

When sensitive information is encountered:

• Stop testing immediately.
• Do not retain more information than necessary.
• Do not share the information with anyone else.
• Redact sensitive values from screenshots and reports.
• Explain what was encountered without transmitting unnecessary copies of the information.
• Follow reasonable deletion instructions after the report is received.

Reporting a Vulnerability

Suspected vulnerabilities should currently be reported to:

Include as much of the following information as reasonably possible:

Our Response Process

Corenth Technologies reviews good-faith reports and may take steps such as:

• Acknowledging receipt when reasonably possible.
• Requesting clarification or additional evidence.
• Assessing the affected asset and potential impact.
• Attempting to reproduce the reported behavior.
• Prioritizing the issue according to risk and available resources.
• Developing, testing, and deploying a correction or mitigation.
• Communicating material status changes when reasonably possible.
• Coordinating with affected providers or customers where necessary.

The time required to assess or address a report may depend on its severity, complexity, reproducibility, provider involvement, customer impact, legal obligations, and available resources.

Coordinated Disclosure

Researchers are asked to keep vulnerability details confidential while Corenth Technologies investigates and responds.

Do not publicly disclose technical details, proof-of-concept code, affected accounts, customer information, exploitation instructions, or unresolved security weaknesses without first coordinating with Corenth Technologies.

Corenth Technologies may request reasonable additional time when:

• The issue requires a complex architectural change.
• A third-party provider must participate in remediation.
• A correction requires extensive testing or customer coordination.
• Immediate disclosure would create a material risk of exploitation.
• Legal, regulatory, or notification requirements are involved.

Publication timing, credit, technical detail, and any vulnerability identifier should be coordinated separately based on the circumstances of the report.

Rewards and Recognition

Corenth Technologies does not currently operate a paid bug-bounty program and does not promise payment, compensation, gifts, employment, services, discounts, or other rewards for vulnerability reports.

A report should not be submitted with a demand for payment or a threat to disclose, exploit, sell, or withhold information.

Corenth Technologies may choose to recognize a researcher publicly, but only with the researcher’s permission and without creating an obligation to provide recognition in other cases.

Policy Limitations

This policy:

• Does not authorize violations of applicable law.
• Does not authorize access to another person’s account, system, device, records, or information.
• Does not provide authorization on behalf of customers, providers, affiliates, partners, or other third parties.
• Does not create a contract for compensation, employment, services, confidentiality, or intellectual-property rights.
• Does not guarantee that every report will be acknowledged, investigated, accepted, remediated, disclosed, or rewarded.
• Does not prevent Corenth Technologies from responding to harmful, unlawful, deceptive, reckless, or out-of-scope conduct.

Researchers remain responsible for understanding and complying with applicable laws and the policies of any affected third party.

Changes to This Policy

Corenth Technologies may update this policy as the Service, infrastructure, production scope, providers, security procedures, legal requirements, and reporting capabilities change.

Updated versions will be posted on this page with a revised “Last updated” date.

Researchers should review the current version before beginning any authorized testing because scope and limitations may change.

Contact Information

Security vulnerabilities and questions about this policy may be submitted to:

cdean@corenthtech.com is the current vulnerability-reporting contact. Corenth Technologies may introduce a dedicated security address and a security.txt file in the future.