Responsible disclosure

ARRTECH builds security software, so we expect people to test ours. We want to hear about any vulnerability found in arrtech.ai or in an ARRTECH product, and this page explains how to report it. Reports go to one address, security@arrtech.ai, which is also our product security incident response (PSIRT) contact.

Scope

This policy covers arrtech.ai and its subdomains, services that ARRTECH operates itself, and ARRTECH products, including the Cyberdroid platform, wherever they are deployed. An issue found in a customer’s deployment of an ARRTECH product should be reported to us, and we will coordinate with the customer.

Out of scope

• Third-party services we use but do not operate, such as the consultation booking widget. Those belong to their providers’ own programs.
• Denial of service, resource exhaustion, and any volumetric testing.
• Social engineering of ARRTECH staff, customers, or partners.
• Physical attacks on facilities or hardware.
• Findings that require an already compromised device or account to exploit.
• Output from automated scanners with no demonstrated impact.

How to report

Email security@arrtech.ai. Include the product or URL affected, the steps to reproduce, and the reporter’s assessment of the impact. Proof-of-concept code and screenshots help. A working exploit is not required.

We do not publish a PGP key yet. If a report contains sensitive material, send a first message with no details, and we will set up an encrypted channel before the details are shared.

What we do with a report

We acknowledge every report within three business days. We confirm whether we can reproduce the issue, tell the reporter what we plan to do about it, and keep them informed until it is fixed. We aim to resolve confirmed vulnerabilities within 90 days of the report, and sooner for anything actively exploitable. If a fix needs coordination with customers or a third party, we will say so and agree on a timeline with the reporter.

Guidelines for researchers

To keep research inside this policy:

• Test only systems in scope, and only as far as needed to demonstrate the issue.
• Do not access, modify, delete, or exfiltrate data that belongs to someone else.
• On reaching personal data, customer data, or credentials, stop, record only what is needed to report the finding, and tell us.
• Do not degrade service for other users.
• Do not use a finding to pivot into other systems, to keep access, or to show impact beyond a proof of concept.
• Do not share the vulnerability with anyone else before it is fixed, except as described under Public disclosure below.

Safe harbor

If a researcher follows this policy in good faith, we treat the research as authorized. This page is the written authorization for security testing referred to in our Terms of Use. We will not pursue or recommend legal action against the researcher for research conducted under it. We will not pursue claims against the researcher for circumventing technical controls to the extent that was necessary to conduct the research.

This authorization covers ARRTECH’s own claims. It does not bind third parties, and it does not cover systems outside scope. If a third party threatens legal action over research conducted under this policy, tell us and we will make it known that the research was authorized.

Public disclosure

We prefer coordinated disclosure. We ask researchers not to publish details until we have fixed the issue or 90 days have passed since the report, whichever comes first, unless we agree on something else. If we need more than 90 days, we will explain why and propose a date. Once the issue is fixed, the researcher is free to publish, and we will review a draft for accuracy on request.

Recognition

We do not run a bug bounty program and do not pay for reports. On request, we will credit the reporter by name or handle on this page once the issue is resolved.

security.txt

Our security contact details are also published in machine-readable form at security.txt.

Contact

security@arrtech.ai. ARRTECH Corporation, 800 Bellevue Way NE, Bellevue, WA 98004.