1. Responsible Disclosure & Safe Harbor Commitment
At dAutomata, the security of our verified AI coworker platform and our customers' private cloud environments is paramount. We actively encourage responsible security research and work closely with ethical hackers and independent security researchers.
Safe Harbor Protection: If you conduct vulnerability research in good faith and in compliance with this policy, dAutomata pledges that:
- We consider your research authorized under relevant computer security laws (including the CFAA and DMCA).
- We will not initiate legal action or pursue criminal complaints against you.
- We will work collaboratively with you to validate, triage, and remediate the issue promptly.
2. Reporting Procedures & PGP Encryption
Please send detailed vulnerability reports to our dedicated security engineering team at:
security@dautomata.com
When submitting reports involving sensitive reproduction details, please encrypt your email using our official PGP Public Key:
3. Program Scope & Target Systems
In-Scope Targets:
*.dautomata.com(Central management API, Web console, Incoming alert webhooks).- dAutomata Private Cloud Worker packages and Docker/Helm deployment installers.
- Pre-execution safety rule verification gateways.
- Single Sign-On (SAML 2.0 / SCIM) authentication endpoints.
Out-of-Scope Targets:
- Volumetric denial-of-service (DDoS/DoS) attacks against platform infrastructure.
- Social engineering, phishing, or physical attacks targeting dAutomata employees or offices.
- Third-party services connected by customers (e.g. AWS, Slack, Stripe, Datadog APIs).
- Attacks requiring physical access to an unlocked, logged-in customer computer.
4. Bug Bounty Reward Matrix
We reward eligible, qualifying vulnerability reports based on CVSS v3.1 severity scores and real-world impact:
| Severity Tier | CVSS v3.1 Score | Example Vulnerability | Reward Range |
|---|---|---|---|
| Critical | 9.0 – 10.0 | Remote Code Execution (RCE) inside an isolated worker sandbox, cross-workspace data access, or bypassing a locked safety rule. | $2,500 – $10,000+ |
| High | 7.0 – 8.9 | Privilege escalation within a customer workspace, authentication bypass on incoming webhooks, or credential exposure. | $1,000 – $2,500 |
| Medium | 4.0 – 6.9 | Stored Cross-Site Scripting (XSS) affecting workspace administrators, CSRF on state-changing actions, or unauthorized object access (IDOR). | $250 – $1,000 |
| Low | 0.1 – 3.9 | Minor information disclosures or missing defense-in-depth headers without practical exploitability. | Swag + Hall of Fame |
5. Response Time Commitments (SLAs)
Our dedicated security incident response team adheres to strict communication timelines:
- Initial Acknowledgment: Within 24 business hours of receipt.
- Triage & Verification: Within 72 business hours with severity assignment.
- Critical Remediation Target: Security patch deployed within 48 hours of verification.
- Bounty Payment: Issued within 7 business days after verification via bank transfer.
6. Enterprise Technical Security Controls
For enterprise customers evaluating our security posture, dAutomata enforces the following security baselines across our platform:
- Transport Security: Strict TLS 1.3 encryption enforced on all external connections with HSTS preloaded (`max-age=31536000; includeSubDomains; preload`).
- Isolated Sandbox Execution: Worker tool execution runs inside isolated micro-containers with restricted permissions and zero access to host systems.
- Tamper-Proof Audit Signing: Every workflow step is digitally signed using hardware-protected keys stored in FIPS 140-2 Level 3 security modules.
- Zero Shared Memory: Worker memory is allocated per task and wiped clean immediately after execution.