Vulnerability disclosure policy

1. Scope

In scope: this website, the customer portal and the APIs behind them.

Out of scope: our customers' systems, third-party services we use (report those to the vendor), denial-of-service, social engineering, physical attacks and findings from automated scanners without a demonstrated impact.

2. Rules

• Use only accounts you created, and access only your own data. Stop and report as soon as you reach someone else's data.
• Do not degrade the service, modify data or keep any data you see.
• Give us reasonable time to fix the issue before disclosing it publicly. We aim for 90 days.

3. What to include

The affected URL or endpoint, steps to reproduce, the impact you observed and your contact details. Please do not include customer data in the report.

4. What we do

We acknowledge reports within 3 business days, keep you updated, and credit you when the fix ships if you want. We do not currently offer cash rewards.

5. Safe harbor

If you follow this policy in good faith, we will not pursue or support legal action against you for your research, and we consider it authorized under applicable anti-hacking laws. If a third party brings action against you for research that followed this policy, we will make clear that it was authorized.

6. Contact

Marcos Morris, Bentonville, Arkansas. Contact: privacy@infrascanai.com.