https://heldaway.ai/_nuxt/security.a30c6de7.js

1import{f as a,G as t,o as e,e as o,a5 as i,a as d}from"./entry.858289dc.js";const s={class:"vdp"},r=i('<h1 data-v-ad73849d>Vulnerability Disclosure Policy</h1><p class="updated" data-v-ad73849d>Last updated: 11 August 2026</p><p data-v-ad73849d> Distributary operates <strong data-v-ad73849d>heldaway.ai</strong>, <strong data-v-ad73849d>evmgmt.ai</strong> and <strong data-v-ad73849d>distributary.io</strong> (together, the &quot;Services&quot;). We take the security of our systems and our customers&#39; data seriously and we welcome reports from security researchers acting in good faith. This policy explains how to report a vulnerability to us, what you can expect in return, and the rules for testing. </p><p data-v-ad73849d> This is a coordinated disclosure policy, <strong data-v-ad73849d>not a bug bounty program</strong>. We do not offer monetary rewards. See &quot;Rewards&quot; below. </p><h2 data-v-ad73849d>Scope</h2><p data-v-ad73849d>The following systems are in scope:</p><ul data-v-ad73849d><li data-v-ad73849d><code data-v-ad73849d>heldaway.ai</code> and its subdomains</li><li data-v-ad73849d><code data-v-ad73849d>evmgmt.ai</code> and its subdomains</li><li data-v-ad73849d><code data-v-ad73849d>distributary.io</code> and its subdomains</li><li data-v-ad73849d><code data-v-ad73849d>work.heldaway.ai</code> (the application)</li></ul><h2 data-v-ad73849d>Out of scope</h2><p data-v-ad73849d> The following are explicitly out of scope. Reports limited to these, without a demonstrated, realistic security impact, will be closed without further action: </p><ul data-v-ad73849d><li data-v-ad73849d>Denial of service (DoS/DDoS), volumetric, or resource-exhaustion testing</li><li data-v-ad73849d>Social engineering, phishing, or physical attacks against our staff, users, or offices</li><li data-v-ad73849d>Reports from automated scanners without a working proof of concept</li><li data-v-ad73849d>Missing security headers (CSP, HSTS, etc.) with no demonstrated exploit</li><li data-v-ad73849d>Missing or misconfigured SPF, DKIM, or DMARC records</li><li data-v-ad73849d>TLS/SSL configuration weaknesses (cipher suites, versions) without a working exploit</li><li data-v-ad73849d>Software or framework version disclosure without a linked, exploitable vulnerability</li><li data-v-ad73849d>Self-XSS, or issues requiring an already-compromised device or browser</li><li data-v-ad73849d>Clickjacking on pages with no sensitive state-changing actions</li><li data-v-ad73849d>Rate-limiting or brute-force findings without demonstrated impact</li><li data-v-ad73849d>Best-practice or informational findings with no security impact</li></ul><h2 data-v-ad73849d>How to report</h2><p data-v-ad73849d> Email <a href="mailto:[email protected]" data-v-ad73849d>[email protected]</a>. Please include: </p><ul data-v-ad73849d><li data-v-ad73849d>The affected Service, URL, and component</li><li data-v-ad73849d>A clear description of the issue and its security impact</li><li data-v-ad73849d>Step-by-step reproduction details, including a proof of concept where possible</li><li data-v-ad73849d>Any relevant logs, requests, or screenshots</li></ul><p data-v-ad73849d> Please report one issue per email, and give us a reasonable opportunity to respond before disclosing to anyone else. </p><h2 data-v-ad73849d>What to expect</h2><ul data-v-ad73849d><li data-v-ad73849d>We will acknowledge your report within <strong data-v-ad73849d>10 business days</strong>.</li><li data-v-ad73849d>We will work to validate the report and keep you informed of our progress.</li><li data-v-ad73849d>We ask that you keep the details of any vulnerability confidential until we have had a reasonable opportunity to remediate it.</li></ul><h2 data-v-ad73849d>Rules of engagement</h2><p data-v-ad73849d>When researching, we ask that you:</p><ul data-v-ad73849d><li data-v-ad73849d>Only test against systems listed in scope above.</li><li data-v-ad73849d>Make a good-faith effort to avoid privacy violations, data destruction, and interruption or degradation of our Services.</li><li data-v-ad73849d>Do not access, modify, or exfiltrate data that does not belong to you. Use only test accounts you own.</li><li data-v-ad73849d>Stop testing and notify us immediately if you encounter customer data.</li><li data-v-ad73849d>Do not use automated scanning at a volume that could degrade the Services.</li></ul><h2 data-v-ad73849d>Safe harbour</h2><p data-v-ad73849d> If you make a good-faith effort to comply with this policy during your research, we will c

1onsider your testing to be authorised, we will work with you to understand and resolve the issue quickly, and we will not pursue or support legal action against you related to your research. To the extent permitted by applicable law, we waive any relevant claims against you for good-faith security research conducted in line with this policy. This policy does not authorise action inconsistent with applicable law, and it does not bind any third party. </p><h2 data-v-ad73849d>Rewards</h2><p data-v-ad73849d> We do not operate a bug bounty program and do not offer monetary rewards, gifts, or other compensation for reports. By submitting a report you agree that you are not entitled to, and waive any claim to, compensation for the submission. We are grateful for responsible disclosure and are happy to acknowledge researchers who wish to be credited once an issue is resolved. </p><p class="contact-line" data-v-ad73849d> Security contact: <a href="mailto:[email protected]" data-v-ad73849d>[email protected]</a> \xB7 <a href="/.well-known/security.txt" data-v-ad73849d>security.txt</a></p>',24),n=[r],l=a({__name:"security",setup(c){return t({title:"Security & Vulnerability Disclosure Policy",meta:[{name:"description",content:"How to report a security vulnerability to Distributary (heldaway.ai, evmgmt.ai, distributary.io) and what to expect in return."},{name:"robots",content:"index, follow"}]}),(u,p)=>(e(),o("main",s,n))}});const v=d(l,[["__scopeId","data-v-ad73849d"]]);export{v as default};