1. Reporting a Vulnerability
Please report suspected security vulnerabilities by emailing security@mindaeon.com with reproduction steps, affected component/version, and impact assessment. Our machine-readable disclosure descriptor is published at /.well-known/security.txt.
2. Response & Remediation SLAs
- Initial Acknowledgment: Within 24 hours of receipt.
- Severity Triage & Validation: Within 3 business days.
- Critical / High Remediation Target: Patch and signed release catalog update within 7 days.
3. Legal Safe Harbor
Mindaeon will not initiate civil action or law enforcement referral against researchers who conduct good-faith testing against their own tenant workspaces without disrupting other customers, exfiltrating third-party data, or conducting denial-of-service attacks.
4. In-Scope Surfaces
mindaeon.com,mindaeon.ai,app.mindaeon.com, and Control Plane APIs- Mindcode CLI, Mindaeon Desktop, VS Code Extension, Browser Extension, and Office 365 Add-in
- Open Policy Agent (OPA) tool-gate bypasses, test-tampering guard bypasses, and Ed25519 manifest verification