Vulnerability Disclosure Policy

Last updated: August 13, 2026

Effective: August 13, 2026

Aethyr Research LLC ("Aethyr," "we," "us," or "our") builds software that our customers run on their own hardware, including on-premises and air-gapped deployments. That deployment model makes coordinated disclosure genuinely important: when a customer holds the binary, a clear and timely advisory is the only reliable way for them to learn that they need to upgrade. This policy describes how to report a vulnerability to us and what we commit to in return.

1. Scope

The following are in scope for security research under this policy:

• Aethyr Console, including self-managed deployments you operate yourself
• AiOS and the Aethyr agent runtime
• The Aethyr mobile application
• Aethyr-operated web properties: aethyrresearch.com, staging.aethyr.cloud, and registry.aethyr.cloud

The following are out of scope. Please do not test against these:

• Customer production deployments. Aethyr software running on a customer's infrastructure belongs to that customer. We cannot grant you permission to test systems we do not operate, and doing so may expose you to legal risk we have no ability to waive.
• Third-party services and vendors we depend on. Report those to the vendor directly.
• Social engineering, phishing, or physical attacks against Aethyr staff or facilities.
• Denial of service, volumetric load testing, or anything intended to degrade availability for other users.
• Findings from automated scanners with no demonstrated security impact, including missing headers or informational TLS warnings without a working attack path.

2. How to Report

Send your report to security@aethyrresearch.com. A useful report usually includes:

• The affected product, version, and deployment type (self-hosted, staging, mobile).
• A description of the issue and why you believe it has security impact.
• Steps to reproduce, ideally with a proof of concept.
• Any logs, screenshots, or request captures that help us confirm the finding.
• How you would like to be credited in the advisory, or whether you prefer to stay anonymous.

Please report in English where you can. If your report contains sensitive material and you would prefer to encrypt it, email us first and we will arrange a key exchange.

3. What We Commit To

If we disagree about severity or timing, we will say so plainly rather than let the clock run out in silence. If we go quiet past these windows, you are free to disclose.

4. Advisories and CVEs

For vulnerabilities we assess as high or critical severity in software our customers deploy, we will publish an advisory and request a CVE identifier, so that operators running our software have a durable public record they can track against their own inventory. Advisories name the affected versions, the fixed version, and the root cause.

We credit reporters by name unless you ask us not to. Tell us how you want to be listed.

5. Safe Harbor

If you make a good-faith effort to comply with this policy during your research, we will consider your research authorized, we will not pursue or support legal action against you, and we will not report you to law enforcement. If a third party brings legal action against you for research conducted in accordance with this policy, we will make it known that your activity was authorized.

This safe harbor is limited to systems listed as in scope above, and it applies only where you:

• Stop testing and report immediately once you discover a vulnerability.
• Avoid accessing, modifying, or deleting data that is not your own, and use test accounts wherever possible.
• Do not exfiltrate, retain, or publish customer or personal data. If you encounter such data, stop and tell us.
• Do not degrade or disrupt service for other users.
• Give us reasonable time to remediate before disclosing publicly, as described above.

This policy does not authorize activity that violates applicable law, and it does not grant permission to test systems operated by our customers or by third parties. If you are unsure whether a specific action is covered, email us and ask before you proceed. We would much rather answer the question than argue about it afterwards.

6. Rewards

Aethyr does not currently run a paid bug bounty program, and we do not want anyone spending significant effort under a mistaken assumption about payment. What we do offer is a prompt response, honest triage, public credit if you want it, and a named acknowledgment in the resulting advisory.

7. Contact

Non-security support questions belong at Support. Sending them to the security address slows down the reports that need attention.