Vulnerability Disclosure Policy

Our commitment

NotAI protects data that students, educators, and institutions entrust to us, and we take the security of our platform seriously. Independent security researchers play a valuable role in keeping that promise, and we welcome good-faith research into our systems.

If you believe you have found a vulnerability in a NotAI service, we want to hear from you. We will work with you to understand the issue, validate it, and remediate it. This policy explains what is in scope, how to reach us, and what you can expect in return.

Scope

This policy covers the following systems and software operated by NotAI:

• isnotai.com and www.isnotai.com — the marketing website
• dash.isnotai.com — the customer dashboard
• api.isnotai.com — the platform API
• trust.isnotai.com — this trust center
• The NotAI Pixel and Text Monitor client libraries

If you are unsure whether a particular system or behavior is in scope, ask us at [email protected] before you begin testing.

Out of scope

The following activities and targets are outside the scope of this policy:

• Denial of service. Do not run denial-of-service tests, volumetric attacks, or any activity intended to degrade the availability of our services.
• Social engineering. Do not phish, impersonate, or otherwise socially engineer NotAI staff or our customers.
• Physical attacks. Do not attempt physical access to people, offices, or infrastructure.
• Third-party services. Services we use but do not operate are outside NotAI's control. If you find a vulnerability in a third-party service, report it to that vendor through their own disclosure program.

How to report

Email your report to [email protected]. To help us triage quickly, please include:

• Clear steps to reproduce the issue
• The affected URLs, endpoints, or library versions
• Your assessment of the impact if the issue were exploited

We accept reports in English. Screenshots, request/response captures, and proof-of-concept detail are welcome where they help demonstrate the issue.

What to expect

When you report a vulnerability under this policy:

• We will acknowledge your report within three business days.
• We will keep you informed of our progress as we triage, validate, and remediate the issue.
• We follow coordinated disclosure. We ask that you give us reasonable time to remediate before any public disclosure, and we are glad to coordinate disclosure timing with you.

Safe harbor

Security research conducted in good faith and in accordance with this policy will not result in legal action by NotAI. We consider such research authorized, and if a third party raises a legal question about research you conducted under this policy, we will make it known that your activities were authorized by us.

Good faith means acting to improve security, not to cause harm. In particular, do not access, modify, or exfiltrate data belonging to others, and do not use a vulnerability to pivot beyond the minimum testing needed to demonstrate that it exists.

Recognition

We do not operate a paid bounty program at this time. With your permission, we credit reporters of validated vulnerabilities on our Updates page once the issue has been remediated. If you prefer to remain anonymous, we will honor that.