Vulnerability Disclosure Policy (VDP) & Coordinated Disclosure

Document Reference: AUC-TECH-VDP-001
Version: 3.2.0
Effective Date: October 24, 2026
Last Updated: October 24, 2026
Classification: Public / Security Trust
Standards Alignment: ISO/IEC 29147:2018 | ISO/IEC 30111:2019 | IETF RFC 9116 | DOJ Vulnerability Disclosure Framework

Executive Summary (ISO 24495-1 Plain-Language Overview)

[!IMPORTANT] Legal Precedence Notice: This plain-language summary is provided solely for reader convenience and researcher guidance pursuant to ISO 24495-1:2023. It reflects policy rules and Safe Harbor commitments. In the event of any conflict, governing statutory definitions and operative policy articles strictly prevail.

• Safe Harbor Authorization: Auctoric considers good-faith security research complying with this policy to be authorized under CFAA (18 U.S.C. § 1030) and DMCA (17 U.S.C. § 1201), waiving legal claims against bona fide researchers.
• In-Scope Boundaries: Covers web platforms, developer APIs (api.auctoric.ai), official client SDKs, and model serving guardrails (tested in researcher sandbox accounts).
• AI Vulnerability Testing: Actively encourages reports of prompt injection, model context leakage, and guardrail bypasses. Testing against live customer tenants or exfiltrating customer data is strictly out-of-scope.
• Response SLAs: Adheres to ISO/IEC 29147 standards: acknowledgement within 48 hours, triage assessment within 5 business days, and standard 90-day coordinated disclosure.
• Intake & Attribution: Submissions handled via security@auctoric.ai, RFC 9116 security.txt, and honored via the public Researcher Hall of Fame.

High-Intent Disclosure FAQ (AEO Direct Answers)

Does Auctoric provide legal Safe Harbor for security researchers?

Yes. Under Section 2, Auctoric considers good-faith vulnerability research adhering to this policy authorized under the Computer Fraud and Abuse Act (CFAA) and Digital Millennium Copyright Act (DMCA), pledging not to pursue civil or criminal action against complying researchers.

Can security researchers test AI safety guardrails and prompt injection?

Yes. Under Section 3.2, research into prompt injection, cross-tenant context leakage, and safety filter bypasses is authorized, provided testing occurs exclusively within dedicated researcher test accounts and never against commercial customer tenants.

What is Auctoric’s response timeline for vulnerability submissions?

Under Section 5, Auctoric adheres to ISO/IEC 29147 targets: initial acknowledgment within < 48 hours, severity triage within < 5 business days, status updates every 14 days, and production patch deployment target < 30 calendar days.

1. Overview and Commitment

Auctoric, LLC (“Auctoric”) values the contributions of the independent security research community. We believe that public safety, platform resilience, and trustworthy AI are enhanced through transparent, coordinated collaboration.

This Vulnerability Disclosure Policy (“Policy”) defines the terms under which security researchers may discover and report potential vulnerabilities in Auctoric systems, APIs, and AI models in an authorized, good-faith manner.

2. Safe Harbor Commitment (Auctoric Authorization & Legal Scope)

Auctoric considers good-faith security research conducted in strict accordance with this Policy to be authorized by Auctoric:

• Auctoric Non-Assertion: Auctoric will not pursue civil litigation or initiate criminal complaints against researchers for accidental, good-faith research adhering to this Policy.
• CFAA Authorization: Auctoric considers activities adhering to this Policy to be authorized access under the Computer Fraud and Abuse Act (18 U.S.C. § 1030) and state equivalents with respect to Auctoric-owned systems.
• DMCA Safe Harbor: Auctoric will not assert claims against researchers under the Digital Millennium Copyright Act (17 U.S.C. § 1201) for circumventing technological measures protecting Auctoric software or model weights during good-faith security research.
• Scope Limitation: Researchers acknowledge that Auctoric’s Safe Harbor represents a waiver of Auctoric’s claims and cannot bind, grant immunity from, or restrict third-party cloud infrastructure providers (cataloged in the Sub-processor Schedule) or law enforcement authorities.

3. Scope of Systems & Research Boundaries

3.1 In-Scope Assets

• https://*.auctoric.ai (Main web platform, developer console, documentation)
• https://api.auctoric.ai (Core AI inference and agent orchestration REST/gRPC endpoints)
• Auctoric Open-Source Client SDKs (Python, TypeScript, Go)
• Model Serving & Inference Pipelines (including guardrail testing in dedicated researcher sandbox environments)

3.2 AI-Specific In-Scope Research (Authorized Testing Carve-Out)

We actively encourage reporting of AI-specific security vulnerabilities (OWASP LLM Top 10) when conducted in researcher test accounts:

1. Adversarial Prompt Injection: Exploits allowing untrusted inputs to override system prompts and execute unauthorized agentic tool commands;
2. Multi-Tenant Inversion / Data Leakage: Techniques that induce models to reveal private training records, RAG embeddings, or cross-tenant context;
3. Guardrail Bypasses: Novel methodologies that circumvent safety classifiers to generate prohibited CBRN, CSAM, or cyberattack payloads.

(Note: In accordance with our Acceptable Use Policy, testing must occur solely on accounts and endpoints provisioned for security evaluation, not against production commercial tenants.)

3.3 Out-of-Scope Systems & Activities

The following activities are strictly prohibited and do not qualify for Safe Harbor:

• Distributed Denial of Service (DDoS) attacks or intentionally degrading platform availability;
• Physical attacks against offices, employees, or data center facilities;
• Social engineering, spear-phishing, or vishing targeting Auctoric employees, contractors, or customers;
• Accessing, modifying, exfiltrating, or retaining real customer data (if you encounter customer data, stop immediately and notify us);
• Simple model “hallucinations” that do not represent an exploit, security vulnerability, or safety guardrail evasion.

4. How to Report a Vulnerability

Submit vulnerability findings via our secure intake channel or encrypted email:

• Intake Form: https://trust.auctoric.ai/security/report
• Security Contact Email: security@auctoric.ai
• PGP Encryption Key: Download public key at https://trust.auctoric.ai/security/pgp-key.asc
• RFC 9116 security.txt: Hosted at https://auctoric.ai/.well-known/security.txt

4.1 Information to Include

To accelerate triage, please provide:

1. Clear description of the vulnerability and potential real-world impact;
2. Step-by-step reproduction instructions or proof-of-concept (PoC) code/prompts;
3. Affected endpoints, parameters, model names, or versions;
4. Any relevant HTTP request/response transcripts.

5. Our Response Commitments & Timelines

Auctoric adheres to standardized ISO/IEC 29147 communication targets:

6. Coordinated Public Disclosure Policy

Auctoric supports coordinated vulnerability disclosure:

• We request that researchers refrain from sharing details of the vulnerability with third parties or the public until ninety (90) days after initial disclosure or until Auctoric has deployed a verified remediation.
• If Auctoric resolves the vulnerability prior to 90 days, mutual disclosure may occur sooner upon agreement.

7. Researcher Recognition

Auctoric maintains a Security Researcher Hall of Fame at https://trust.auctoric.ai/security/hall-of-fame honoring individuals who help secure our infrastructure in good faith.