Vulnerability Disclosure Policy

​

1. How to report

Email security@neurobro.ai. Please include:

• the affected domain, endpoint or app screen;
• a description of the issue and its impact;
• clear steps to reproduce it, with any proof-of-concept code, requests or screenshots;
• the account you used for testing (your own); and
• how you would like to be credited, if at all.

Write in English. Report privately: do not post the issue publicly, in our community channels, in support chat or on social media.

​

2. Scope

The following systems are in scope:

• neurobro.ai
• app.neurobro.ai
• api-mobile.neurobro.ai
• neurodex.ai
• api-mobile.neurodex.ai
• neuroapi.neurobro.ai
• api.neurobro.ai
• the NeuroAPI MCP server at api.neurobro.ai/api/v1/mcp
• the Neurobro mobile apps for iOS (App Store) and Android (Google Play)
• public repositories under github.com/axioma-ai-labs

Anything not listed is out of scope. If you are unsure, ask us at security@neurobro.ai before testing. AI agents. Our AI agents, including the in-app assistant and our AI support agents, are in scope when you test them from your own account. Prompt injection or other manipulation is in scope when it exposes another user’s data, our credentials or internal systems, or makes an agent take an action you are not permitted to take. Jailbreaks, system prompt extraction and replies that are only off-policy, offensive or inaccurate, with no security impact, are out of scope.

​

3. Out of scope

The following are not authorized and are not covered by safe harbor:

• Denial of service - DoS, DDoS, load, stress or flooding tests of any kind, against any host or endpoint.
• Degrading production - any test that impairs availability or performance for other users, or damages or destroys data.
• Brute force and automated attacks - brute-forcing logins, one-time codes or API keys, password spraying, credential stuffing and fuzzing, unless we have authorized it in writing.
• Bypassing bot protection - circumventing captchas, bot detection, firewalls or rate limits, for example with browser emulation, proxies or IP rotation.
• Stolen or leaked credentials - using credentials, API keys, session tokens or wallet keys that you did not create yourself. If you find leaked credentials, report them without using them.
• Social engineering - phishing, vishing, pretexting or any other attempt to deceive our team, partners or users.
• Physical attacks - against our offices, data centers, devices or people.
• Other users’ data or funds - accessing, modifying, deleting, moving or retaining data, accounts, wallets or funds that are not your own. If you reach anything that is not yours, stop at the first proof and report it.
• Third-party services we use, such as Privy, Jupiter, Relay, payment providers, app stores and infrastructure providers. Report those findings to the vendor under its own program. A flaw in how we integrate a vendor is in scope.

We also generally do not accept reports of the following unless you demonstrate a concrete security impact: automated scanner output, missing security headers or cookie flags, clickjacking on pages with no sensitive action, self-XSS, logout CSRF, user or email enumeration, SPF/DKIM/DMARC settings, software version disclosure, attacks that require a compromised device or a man-in-the-middle position on the victim’s network, and theoretical issues without a working proof of concept.

​

4. Rules

Under this policy, “research” means activities in which you:

• notify us as soon as possible after you discover a real or potential security issue;
• make every effort to avoid privacy violations, degradation of user experience, disruption to production systems, and destruction or manipulation of data;
• use only accounts you own or have explicit permission to use;
• only use exploits to the extent necessary to confirm a vulnerability’s presence, and do not use an exploit to compromise or exfiltrate data, establish persistent command line access, or pivot to other systems;
• wait 90 days from your report, or until a fix ships if that is sooner, before disclosing the issue publicly; we will coordinate the date with you; and
• do not submit a high volume of low-quality reports.

Once you have established that a vulnerability exists, or you encounter any sensitive data (such as personal or financial data, wallet keys or trade secrets), you must stop your test, notify us immediately, not disclose this data to anyone else, and delete any copies of it.

​

5. Safe harbor

When conducting vulnerability research according to this policy, we consider this research to be:

• authorized in accordance with any applicable anti-hacking laws, such as the U.S. Computer Fraud and Abuse Act (CFAA), and we will not initiate or support legal action against you for accidental, good faith violations of this policy;
• authorized in accordance with any relevant anti-circumvention laws, such as the Digital Millennium Copyright Act (DMCA), and we will not bring a claim against you for circumvention of technology controls;
• exempt from restrictions in our Terms of Use, API Terms of Service and any other agreement with us that would interfere with conducting security research, and we waive those restrictions only for the limited purpose of research under this policy; and
• lawful, helpful to the overall security of the Internet, and conducted in good faith.

If this policy conflicts with our Terms of Use, API Terms of Service or any other agreement with us, this policy takes precedence for research conducted under it. You are expected, as always, to comply with all applicable laws. If legal action is initiated by a third party against you and you have complied with this policy, we will take steps to make it known that your actions were conducted in compliance with this policy. Safe harbor covers only legal claims under our control and does not bind third parties, including the vendors in section 3. It does not apply to the out-of-scope activities in section 3, or to reports made under threat or conditioned on payment. If you are unsure whether your research is consistent with this policy, contact security@neurobro.ai before going further.

​

6. What to expect from us

• We acknowledge your report within 3 business days.
• We confirm whether the issue is valid and in scope, and keep you updated as we work on a fix.
• We tell you when the issue is resolved, and credit you if you wish.

​

7. Rewards

We do not run a paid bug bounty program. For valid, in-scope, reproducible findings reported under this policy, we may offer a thank-you. Whether we do, and in what form, is at our sole discretion, and we have no obligation to offer anything. We do not pay for out-of-scope findings, findings obtained by breaking this policy, or reports conditioned on payment.

​

Contact