Security Disclosure & Vulnerability Reporting

1. Our Commitment¶

Security is the foundation of SecurePDF AI — not a feature. We operate a no-account service that encrypts every upload at rest and purges it at the end of your tier’s download window. We recognize the responsibility that comes with handling other people's files. We are committed to:

• Investigating every credible report of a security vulnerability promptly and in good faith.
• Communicating clearly with researchers about triage status, remediation timelines, and disclosure.
• Crediting researchers who report responsibly (see Hall of Fame).
• Continuously hardening our systems through audits, dependency monitoring, and defense-in-depth engineering.

2. Reporting a Vulnerability¶

If you believe you have discovered a security issue affecting SecurePDF AI, please report it via one of the channels below. We prefer encrypted email for sensitive details.

• Email: [email protected] (preferred — encrypt with our PGP key when possible)

To help us triage quickly, please include:

• A clear description of the vulnerability and its impact.
• Reproduction steps, including any sample files or payloads.
• The affected URL, endpoint, or component.
• Your environment (browser, OS, tooling) if relevant to reproduction.
• Any proof-of-concept code or screenshots. Please do not include third-party user data.

Please do not disclose the issue publicly, to third parties, or via social media until we have had a reasonable opportunity to investigate and remediate (see Response Timelines).

3. Scope¶

Reports against the following assets are in scope and eligible for coordinated disclosure under this policy:

• Web application: the SecurePDF AI tools and processing pipeline served from securepdfai.com and its API endpoints.
• Marketing site: all static and dynamic pages served from securepdfai.com (including the blog, legal pages, and comparison content).
• Service worker, manifest, and PWA artifacts: including sw.js, manifest.json, and related offline functionality.

The following are out of scope, even if they appear to affect SecurePDF AI users:

• Third-party services and dependencies — please report issues directly to the upstream maintainer (e.g., payment providers, DNS or CDN operators, analytics vendors, OSS libraries). We will gladly coordinate where appropriate.
• Findings that require physical access, social engineering of our staff, or compromise of a user's own device or account credentials.
• Volumetric denial-of-service, brute-force, or rate-limit exhaustion testing. Do not run load tests against production.
• Reports based solely on automated scanner output (e.g., missing headers, outdated library versions) without a demonstrated impact.
• Self-XSS, clickjacking on pages without sensitive state, and theoretical issues without a concrete exploitation path.
• Email spoofing or related SPF/DKIM/DMARC findings against non-customer-facing domains.

4. Safe Harbor¶

SecurePDF AI supports good-faith security research. If you make a good-faith effort to comply with this policy during your research, we will:

• Consider your activities authorized and not pursue or support legal action against you (including under anti-hacking statutes such as the Computer Fraud and Abuse Act in the United States, similar laws elsewhere, or our Terms of Service' anti-circumvention clauses).
• Work with you to understand and resolve the issue quickly, and recognize your contribution if you are the first to report it.

To stay within safe harbor, please do not:

• Access, modify, exfiltrate, or destroy data that does not belong to you. If you accidentally access user data while reproducing a bug, stop immediately and report it.
• Degrade service availability for other users (no DoS, no aggressive automated scanning).
• Pivot from a finding into deeper exploitation than is necessary to demonstrate the vulnerability.
• Publicly disclose the issue before we have had a reasonable chance to remediate.

If in doubt about whether an action falls within safe harbor, email [email protected] before proceeding.

5. Response Timelines¶

We aim to handle every report on the following schedule. These are targets, not contractual commitments — complex issues may take longer, and we will keep you informed if they do.

• Initial acknowledgment: within 3 business days of receipt.
• Triage and severity assessment: within 7 business days.
• Status updates: at least every 14 days while a report is open.
• Remediation target: 30 days for critical issues, 60 days for high severity, 90 days for medium, and best effort for low.
• Coordinated disclosure: we are happy to publish a joint advisory once a fix is shipped and users have had a reasonable window to upgrade.

6. Hall of Fame¶

We publicly recognize researchers who have responsibly disclosed vulnerabilities to us. With your permission, we will list your name, handle, or organization here.

To be announced. The Hall of Fame will be populated as valid reports are received and remediated.

7. Bug Bounty¶

We do not currently run a paid bug bounty program. Recognition for valid, responsibly disclosed reports is published in the Hall of Fame. We are evaluating structured rewards for the next phase — if you would like to coordinate a private disclosure ahead of that, please reach out at [email protected].

8. PGP Key¶

For sensitive reports, please encrypt your message using our PGP key. The authoritative copy will be published at /.well-known/pgp-key.txt and referenced from our security.txt.

PGP key fingerprint to be announced. Until the key is published, please use TLS-encrypted email or the web report form for sensitive details, and avoid attaching exploit payloads.

9. Contact¶

For all security-related correspondence: [email protected]. For general inquiries, use [email protected].