Vulnerability Disclosure Policy

Reporting a Vulnerability

If you discover a potential security vulnerability in NeoSpline's products or services, we encourage you to report it responsibly.

Contact: security@neospline.ai

Please include:

• Description of the vulnerability
• Steps to reproduce (if applicable)
• Potential impact assessment
• Any supporting evidence (screenshots, logs)

Our Commitments

• Acknowledgment: We aim to acknowledge your report within 3 business days
• Assessment: We aim to assess the reported vulnerability within 7 business days
• Updates: We will keep you informed of remediation progress
• No retaliation: We will not pursue legal action against researchers who report vulnerabilities in good faith and comply with this policy
• Credit: With your permission, we will acknowledge your contribution once the vulnerability is resolved
• No bounty: This is a coordinated disclosure program, not a paid bug-bounty program. We do not currently offer monetary rewards for reports.

Scope

In scope:

• NeoSpline desktop plugin (current release)
• NeoSpline cloud services and API endpoints
• Authentication and authorization mechanisms
• Data handling and storage

Out of scope:

• Third-party services and dependencies (report to those vendors directly)
• Social engineering or phishing attacks against NeoSpline employees
• Physical security
• Denial-of-service testing

Testing of in-scope cloud services must be confined to NeoSpline's own application layer. The underlying infrastructure is operated by third-party providers (including AWS and Auth0); this policy cannot and does not authorize testing against those providers' infrastructure, and any such testing must comply with the relevant provider's own security-testing policy. NeoSpline's safe harbor below applies only to NeoSpline's own systems.

Out-of-scope methods by arrangement: Denial-of-service testing, load testing, and social engineering are out of scope by default but may be tested with NeoSpline's prior written consent — contact security@neospline.ai to arrange.

Responsible Disclosure Guidelines

We ask that researchers:

• Do not access, modify, or delete data belonging to other users
• Do not disrupt service availability
• Allow reasonable time for remediation before public disclosure
• Do not exploit a vulnerability beyond what is necessary to demonstrate the issue
• Use only your own test accounts and synthetic/test data. Do not use, target, or attempt to access real personal data or Customer Content. If you incidentally access personal data while demonstrating a vulnerability, stop immediately, do not copy, store, or further access it, and tell us in your report — doing so will not, by itself, forfeit the safe harbor.

Legal Safe Harbor

Security research conducted in compliance with this policy is considered authorized. We will not:

• Pursue civil or criminal action against researchers acting in good faith under this policy
• Initiate complaints to law enforcement for accidental, good-faith violations of this policy
• Consider such research a violation of the applicable Terms of Service or Subscription Agreement
• Consider such research a violation of the anti-circumvention provisions of applicable law

Should legal action be initiated by a third party against you for activities conducted in accordance with this policy, we will make this authorization known.

This authorization is conditioned on the researcher:

• Acting in good faith and within the scope defined above
• Complying with the Responsible Disclosure Guidelines in this policy
• Not accessing, modifying, or exfiltrating data beyond the minimum necessary to demonstrate the vulnerability
• Reporting findings to us before any public disclosure

Accidental Discoveries

If you discover a potential vulnerability incidental to normal use of the Services — without having set out to perform security research — reporting it under this policy constitutes good-faith research. You do not need prior authorization to report what you have already observed. We encourage all users to report security concerns regardless of how the issue was discovered.

Remediation Timeline

The timelines below are targets, prioritized by severity. Actual remediation time depends on the complexity of the issue and any third-party dependencies involved.

Contact

Marcel Fiala, CEO & Co-founder and designated Security Officer of NeoSpline ApS.

Vulnerability reports: security@neospline.ai

NeoSpline ApS — see our Imprint for full company details.