Security & Responsible Disclosure

Last updated August 3, 2026

Security researchers who identify vulnerabilities in airays and report them responsibly help protect everyone who uses the service. This policy explains how to report a vulnerability, what we consider in scope, and the safe-harbor commitment we extend to good-faith researchers.

1. Safe harbor

If you make a good-faith effort to comply with this policy during your security research, we will:

Consider your research authorized under the Computer Fraud and Abuse Act (CFAA) and equivalent laws
Not pursue civil action against you
Not initiate criminal complaints against you
Work with you to understand and quickly resolve the issue
Publicly credit you (if you wish) once the issue is fixed

Safe harbor does not apply if you (a) intentionally access, modify, delete, or destroy user data beyond what is necessary to demonstrate the vulnerability, (b) execute attacks that degrade service availability (denial of service), (c) publicly disclose the vulnerability before we have had a reasonable opportunity to fix it (see Section 4), (d) extort us, or (e) violate the privacy or safety of any user.

2. Scope

In scope:

airays.ai and all subdomains (smartchat.airays.ai, studio.airays.ai, api.smartchat.airays.ai, and others)
Cloudflare Workers deployed under the airays.workers.dev subdomain
airays iOS or Android applications (once released)

Out of scope:

Third-party services we use (report to them directly: Clerk, Cloudflare, Paddle, Anthropic, OpenAI, Replicate, ElevenLabs, Deepgram, LiveKit, Sanity, Sentry)
Third-party integrations (Slack, Gmail, Twilio, WhatsApp)
Domain spoofing / phishing without a technical vulnerability in airays
Physical or social-engineering attacks against our team or premises
Reports from automated scanners without a demonstrated exploit
Best-practice hardening recommendations without a demonstrated exploit (e.g., missing security headers where no attack vector is shown)
Rate-limit bypass via obvious techniques (multi-account, distributed source) — please still report, but not eligible for recognition

3. Priority findings

We are especially interested in reports that demonstrate:

Authentication bypass or account takeover
Unauthorized access to other users' messages, memory, or generated content
Bypass of the account-deletion cascade (data persists after deletion)
Bypass of tier entitlement checks (Free user accessing Pro features, Pro user accessing Business features)
Credit or usage manipulation (using premium features without spending credits)
Server-side request forgery, injection, or remote code execution
Privilege escalation across accounts or tenants
Exposure of secrets, API keys, or configuration
Voice-clone consent bypass or watermark removal at generation time
Evidence-chain integrity failures (ability to forge or modify the chain)
Bypass of Emotional Shield or Content Moderation to distribute prohibited content at scale

Reports demonstrating these issues receive our fastest response and, once bug bounties launch, our highest rewards.

4. Disclosure timeline

We commit to the following response schedule for reports submitted through the process below:

Within 3 business days — initial acknowledgment
Within 10 business days — triage decision (accepted / needs more info / out of scope / duplicate)
Within 30 days — status update or fix for high-severity issues
90 days from initial report — public disclosure permitted, unless we've agreed otherwise for a critical issue that needs more time

We follow the coordinated disclosure principles articulated by CISA and Google Project Zero — 90 days by default with extensions negotiated in good faith when needed.

5. How to report

Send reports to security@airays.ai. For sensitive reports, request our PGP key first and we will send it in reply.

A good report includes:

A clear description of the vulnerability
Steps to reproduce (with URL, request/response, screenshots or video)
Impact assessment (what could an attacker do)
Suggested mitigation (optional but appreciated)
Your name and preferred credit (or "anonymous")

6. Rewards

airays does not currently offer monetary rewards for responsible disclosure while the product is in preview. Once we have scoped a bug-bounty budget we will publish reward tiers here. In the meantime we offer:

Public credit on our security acknowledgments page (with your consent)
airays Business tier credit (for verified valid reports)
A direct thank-you and a t-shirt (once we have merch)

7. Testing guidelines

To research in-scope targets safely and lawfully:

Create test accounts on airays.ai; do not test against other users' accounts
Do not access, view, download, modify, or delete data belonging to any user other than yourself
Do not run automated scanners at rates likely to degrade the service (respect a max of ~1 req/sec against production)
Do not exfiltrate more data than necessary to demonstrate the vulnerability
Report immediately if you accidentally access another user's data — do not view further, do not share, do not retain
Do not disclose the vulnerability publicly before we have had opportunity to fix (Section 4)
Do not use social engineering, phishing, or physical attacks

8. Legal

This policy grants a limited safe harbor for good-faith security research within the bounds described above. It is not a license to exceed those bounds. Nothing in this policy limits any obligation we have under applicable law to report vulnerabilities that expose regulated data (payment card data, health records, etc.).

If you have concerns about the safe-harbor scope of a particular test, contact us at security@airays.ai before running the test.

9. Third-party dependencies

airays depends on many third-party services (see the Privacy Policy sub-processor list). If your vulnerability report involves one of those services, please report to them directly. We will help facilitate the report if the issue affects airays users.