Security and Vulnerability Disclosure

1. Reporting a vulnerability

We take the security of our products and our customers' data seriously, and we welcome reports from security researchers and anyone else who finds a weakness. Email cyberdesigner@aiaide.io with the subject "Security report" and include:

• the product and the affected URL, endpoint or app version;
• a description of the issue and its likely impact;
• step-by-step instructions to reproduce it, with any proof-of-concept code, screenshots or video;
• whether you believe it has been exploited, and how we can contact you.

Please do not include other people's personal data in a report. If you need to send something sensitive, tell us in your first email and we will arrange a secure way to receive it. Our machine-readable contact details are at /.well-known/security.txt.

2. What to expect

• We will acknowledge your report within 3 business days.
• We will tell you whether we can reproduce it and how we plan to address it, usually within 10 business days.
• We will keep you informed as we fix it and tell you when it is resolved.
• We ask that you give us 90 days from your report (or until a fix is released, if sooner) before disclosing the issue publicly, and coordinate the timing with us. If we need more time for a complex fix, we will explain why.

3. Scope

In scope:

• co-create.build, the Co-Create web app and its APIs
• the Co-Create apps for iPhone and Android
• aiaide.io
• preview and live sites of apps hosted by Co-Create, only for vulnerabilities in Co-Create's own hosting or isolation (for example, reaching another customer's data), not in the customers' own app code

Out of scope:

• apps built by our customers, except as above. Report those to the app's owner;
• third-party services we use (such as our hosting, payment or AI providers). Report those to the provider;
• denial-of-service or load testing, spam, and social engineering or phishing of our staff or users;
• physical attacks on our offices or equipment;
• findings without a demonstrated security impact, such as missing security headers on pages without sensitive actions, clickjacking on pages with no state-changing action, self-XSS, software version disclosure, rate-limit observations without a practical attack, or reports from automated scanners alone.

4. Rules for testing

When testing, please:

• use only accounts you own or have permission to use, and test against your own data;
• stop and report as soon as you can show a vulnerability, and never access, modify, download or delete data that is not yours beyond the minimum needed to show it;
• avoid degrading the service for others, and never use automated tools that send high volumes of traffic;
• not keep any data you came across, and delete it once your report is resolved;
• not demand payment or other benefits in exchange for not disclosing an issue;
• comply with all applicable laws.

5. Safe harbor

If you make a good-faith effort to follow this policy, we will consider your research authorized, we will not pursue or support legal action against you for it (including under the Computer Fraud and Abuse Act, the Digital Millennium Copyright Act, or our terms' restrictions on security testing and reverse engineering), and we will tell others this if a third party takes action against you over research this policy authorizes. This safe harbor does not cover activity that violates the rules above, harms our users, or breaks the law. If you are unsure whether something is allowed, ask us first.

6. Recognition

We do not currently offer cash rewards. With your permission, we will thank you by name (or handle) on this page once the issue is fixed.

Thanks to: no reports have been credited yet.

7. How we protect your data

Our security practices are summarized in the Trust Center. For questions that are not vulnerability reports, email cyberdesigner@aiaide.io.