Responsible Disclosure Policy

This Policy encourages coordinated disclosure of vulnerabilities in the Services. It covers auric.cx, the Application and CLI, and Auric-controlled infrastructure — not third-party providers, which should be reported to them. Capitalized terms follow Auric's Master Definitions in the Terms of Service.

Email security@auric.cx [FD-013] with steps to reproduce, the affected component, and the impact. Whether a bug-bounty or reward program applies is set by [FD-015]; by default there is no monetary reward during the beta, and recognition is available on request.

If you make a good-faith effort to comply with this Policy, we will not pursue or support legal action against you for your research, and we will treat it as authorized under applicable computer-misuse law. This does not authorize actions against third parties or other users.

Do:

• test only your own accounts and data;
• use the least-impactful methods necessary;
• report promptly; and
• keep findings confidential until we have resolved them.

Do not:

• access, modify, or exfiltrate data that is not yours;
• degrade the Services (no denial-of-service or spam);
• use social engineering or physical attacks; or
• disclose publicly before we agree.

We will acknowledge your report within [FD-015] (target: five business days), triage it, keep you informed, and credit you if you wish. We coordinate public disclosure after a fix is available.

security@auric.cx [FD-013].

v0.1.0 (2026-07-23): Initial draft.