Responsible Disclosure Policy

1. Purpose

Codelive Inc. (“we”, “us”) values the security of AI-ERD. We welcome good-faith security research and reports of vulnerabilities so we can keep our users safe.

2. Scope

This policy applies to security vulnerabilities found in:

• The AI-ERD web application and APIs hosted under ai-erd.com
• AI-ERD infrastructure and services that we own and operate (including production and open beta environments)

Out of scope (examples):

• Third-party services (OAuth providers, analytics, monitoring, hosting providers) except where the issue is caused by our integration
• Social engineering (phishing, vishing), physical attacks, threats/extortion
• Denial of Service (DoS/DDoS) testing, load testing, or any disruption of service
• Reports that only describe missing best practices without a demonstrable security impact
• Issues in user content, weak passwords, or compromised user devices

If you are unsure whether something is in scope, please report it anyway and we will clarify.

3. Safe Harbor (Good-Faith Research)

We consider security research “good faith” when you:

• Make a best effort to avoid privacy violations, data destruction, and service disruption
• Only access data that is strictly necessary to demonstrate the issue
• Stop testing and report promptly once you discover a vulnerability
• Do not use the vulnerability for malicious purposes

Safe Harbor (Our Position)

When you comply with this policy’s scope and guidelines and act in good faith, we will treat your actions as authorized security testing and, as a general rule, we will not initiate legal action against you solely for the research activity.

Exceptions (Not Covered by Safe Harbor)

Safe harbor may not apply if you engage in, attempt, or cause any of the following:

• Testing that clearly falls outside the scope defined in this policy
• Accessing, viewing, modifying, or deleting other users’ data; or collecting/exfiltrating personal or confidential data
• Service disruption (DoS/DDoS, load testing, excessive automated scanning/requests, or other availability impacts)
• Brute force attacks, credential stuffing, spam, or generating malicious traffic
• Installing or distributing malware, backdoors, or persistence mechanisms
• Extortion, monetary demands, selling/reselling vulnerabilities, or any intent to exploit
• Violations of applicable law or third-party rights

Important: This policy describes our position between you and us and cannot bind third parties. We cannot guarantee protection against claims by third parties. However, if you follow this policy in good faith, we may, where appropriate, confirm that your research was performed under this policy. We may also comply with lawful requests or obligations (including law enforcement requests) as required.

4. Testing Guidelines

• Use only your own accounts and test data
• Do not access, modify, or delete other users’ data
• Do not share, publish, or disclose vulnerabilities publicly before we have fixed them (see Section 7)
• Avoid automated scanning that impacts availability
• Do not attempt DoS/DDoS, spam, or brute force attacks

5. How to Report

Please email us with:

• Subject: [Security] AI-ERD Vulnerability Report
• Description of the issue and potential impact
• Reproduction steps / proof of concept (PoC)
• Affected URLs/endpoints, request/response samples (redact secrets)
• Your contact information and preferred method for follow-up

6. Our Response Process

We will review reports and endeavor to respond and take action within a reasonable time (no guaranteed timelines). Response and remediation timing may vary depending on severity, reproducibility, and operational constraints.

We may request additional details to validate or reproduce the issue.

7. Coordinated Disclosure

Please do not publicly disclose details until:

• We confirm a fix is deployed, or
• We agree on a disclosure timeline in writing

We typically aim for coordinated disclosure within 90 days, but this may vary based on severity and operational constraints.

8. Acknowledgment (Optional)

If you request it, we may acknowledge your report privately (e.g., by email). We do not guarantee monetary rewards.

9. Legal Notes

Relationship to our Terms: This policy does not generally waive restrictions in the AI-ERD Terms of Service. Limited authorization is provided only for in-scope, good-faith testing that follows this policy and its guidelines.

This policy does not grant permission to act outside the scope of this policy or applicable law. Your testing must comply with all laws and regulations.

Company Contact: Codelive Inc. — [email protected]