Vulnerability Disclosure Policy.

In scope: any production ShieldMind asset — the website (theshieldmind.com), the dashboard (app.theshieldmind.com), the API (api.theshieldmind.com), the macOS / Windows / Linux agents, and the browser extension.

Out of scope: physical security, social engineering against ShieldMind employees, denial-of-service tests against our infrastructure, automated scanner reports without manual validation, and findings on third-party services we do not control (Supabase, Railway, Vercel, WorkOS — report those to the relevant vendor).

Email bd@dtrasglobal.com. PGP key available at /.well-known/pgp-key.txt for sensitive reports.

Please include: a clear description of the issue, steps to reproduce, the impact you believe it has, and any proof-of-concept. Screenshots and video help.

Do NOT: access, modify, or destroy data that doesn't belong to you; pivot from one finding into accessing other customers' data; publicly disclose before we've had a chance to remediate.

Acknowledgment within 2 business days.

An initial severity assessment within 5 business days.

Regular updates as we triage and remediate.

Public credit on /security/acknowledgments if you'd like (or anonymous if you prefer).

No legal action against good-faith security research conducted within this policy.

We consider security research conducted in line with this policy to be authorized under the Computer Fraud and Abuse Act (US), the Computer Misuse Act (UK), the IT Act 2000 (India), and equivalent statutes. We won't pursue civil or criminal action against researchers acting in good faith. If a third party (e.g. a cloud provider) takes action against you for activity covered by this policy, we will publicly state that your activity was authorized.

We run a private bug bounty program on HackerOne. Submit a quality report via this policy, and we'll invite you to the bounty program where qualifying issues earn cash awards.

Critical (auth bypass, RCE, mass-data exposure): patch within 7 days.

High (privilege escalation, tenant-isolation break): patch within 14 days.

Medium (sensitive info leak, CSRF on impactful action): patch within 30 days.

Low (rate limits, missing security headers): patch within 60 days.