Effective date: 09 September 2024

Responsible Disclosure

The safety and security of our customers is an essential priority for BrainStax and BrainGrounds, and we are committed to it. Toward this end, BrainStax and BrainGrounds have formalised this policy for accepting vulnerability reports in our products. We hope to foster an open partnership with the security community, and we recognize that the work the community does is important in continuing to ensure safety and security for all of our customers.

We have developed this policy to both reflect our corporate values and to uphold our legal responsibility to good-­‐faith security researchers that are providing us with their expertise.

‍This Responsible Disclosure has been created with help of NTIA Safety Working Group’s Vulnerability Disclosure Template Version 1.1.

Scope

This Vulnerability Disclosure Program initially covers the following products:

  • The BrainGrounds Platform
  • The BrainStax and BrainGrounds Website

While BrainStax develops other products, we ask that all security researchers submit vulnerability reports only for the stated product list. We intend to increase our scope as we develop other products.

Legal Posture

We will not engage in legal action against individuals who submit vulnerability reports to BrainStax and BrainGrounds's Security Teams. We openly accept reports for the currently listed products. We agree not to pursue legal action against individuals who:

  • Engage in testing of systems/research without harming BrainStax, BrainGrounds or its customers.
  • Engage in vulnerability testing within the scope of our vulnerability disclosure program.
  • Test on products without affecting customers, or receive permission/consent from customers before engaging in vulnerability testing against their devices/software, etc.
  • Adhere to the laws of their location and the location of BrainStax and BrainGrounds. For example, violating laws that would only result in a claim by BrainStax and BrainGrounds (and not a criminal claim) may be acceptable as BrainStax and BrainGrounds are authorizing the activity (reverse engineering or circumventing protective measures) to improve their systems.
  • Refrain from disclosing vulnerability details to the public before a mutually agreed-­upon time frame expires.

Terms and Conditions

By submitting information in the scope and context of this Policy ("the Report") to BrainStax and BrainGrounds:

  • You agree that you are acting in good faith and commit to adhering to the guidelines laid out in this policy.
  • You agree that BrainStax and BrainGrounds may use the Report to update and/or improve its software; and you grant to BrainStax and BrainGounds a non-exclusive, perpetual, irrevocable, worldwide, royalty-free license, with the right to sublicense to BrainStax and BrainGounds’s licensees and customers, under all relevant intellectual property rights, to use, publish, and disclose the Report in any manner BrainStax and BrainGrounds choose and to display, perform, copy, make, have made, use, sell, and otherwise dispose of BrainStax and BrainGround’s and its sub licensee’s products or services embodying Report in any manner and via any media BrainStax and BrainGrounds choose, without reference to the source. BrainStax and BrainGrounds shall be entitled to use the Report for any purpose without restriction or remuneration of any kind with respect to You and/or Your representatives.

How to Submit a Vulnerability

To submit a vulnerability report to BrainStax and BrainGrounds’s Security Team, please send an e-mail to security@brainstax.com

Preference, Prioritization, and Acceptance Criteria

We will use the following criteria to prioritize and triage submissions.

What we would like to see from you:

  • Well-­written reports in English
  • Reports that include proof-­of-­concept code
  • Reports that include more than only crash dumps or other automated tool output
  • Reports that include how you found the bug, the impact, and any potential remediation.

What you can expect from us:

  • A timely response to your email
  • After triage, we will send an expected timeline, and commit to being as transparent as possible about the remediation timeline as well as on issues or challenges that may extend it.
  • An open dialog to discuss issues.
  • Notification when the vulnerability has been validated and fixed.