Vulnerability Disclosure Policy

Overview

MyndHyve Inc. values the work of security researchers in improving the security of our Services. We encourage responsible disclosure of security vulnerabilities and are committed to working with the security community.

1. Scope

This policy applies to vulnerabilities in:

• The myndhyve.ai web application and subdomains
• Our public APIs
• Our mobile applications (if applicable)

Out of scope:

• Third-party services and integrations
• Social engineering attacks against employees
• Physical security
• Denial-of-service attacks

2. Reporting a Vulnerability

To report a vulnerability, email security@myndhyve.ai with:

• Description of the vulnerability and potential impact
• Steps to reproduce the issue
• Any proof-of-concept code or screenshots
• Your contact information for follow-up

Important: Do NOT publicly disclose the vulnerability before we have had a chance to address it.

3. Our Response

When you report a vulnerability:

• We will acknowledge receipt within 2 business days
• We will provide an initial assessment within 5 business days
• We will keep you informed of our progress
• We aim to resolve critical vulnerabilities within 30 days
• We will credit you in our security acknowledgments (unless you prefer anonymity)

4. Safe Harbor

We will not pursue legal action against researchers who:

• Act in good faith to avoid privacy violations, data destruction, and service disruption
• Only access data necessary to demonstrate the vulnerability
• Do not exploit the vulnerability beyond what is necessary for proof of concept
• Report findings promptly and do not disclose publicly before resolution
• Do not attempt social engineering or physical access

5. Contact

Security team: security@myndhyve.ai

PGP key available at: myndhyve.ai/.well-known/security.txt