Responsible Disclosure Policy

Security testing requires our consent

Security testing of Comp AI is not permitted without our explicit written consent, given in advance. This applies to manual and automated testing alike, including:

• Automated or scripted testing, such as scanners, fuzzers, crawlers and brute-force tools
• Probing for vulnerabilities or trying to bypass access controls by hand
• Reverse engineering our apps, including the device agent and browser extension
• Creating or using Comp AI accounts for anything other than your organization’s own use of Comp AI
• Denial-of-service, spam, social engineering or phishing of our employees or contractors, and attacks on our physical security or third-party services

Testing without our consent may violate our Terms of Service and applicable law, and we may suspend the accounts involved.

Reporting a security issue

If you’re a Comp AI customer and you come across a potential security issue while using Comp AI, email security@trycomp.ai. Don’t investigate further. Tell us what you saw and let our team take it from there. Please include:

• Your organization’s name and the account you were using
• The page or feature where you saw the issue
• What you saw, and the steps that led to it

What this policy covers

This policy covers Comp AI Cloud, including trust portals, the device agent and the browser extension.

Comp AI Community Edition is open source. If you find an issue in its code, email us at the same address. This policy doesn’t cover Community Edition deployments that other organizations host themselves, so don’t test systems you don’t own.

We don’t accept reports about:

• Third-party services we use. Report those to the vendor.
• Clickjacking on pages with no sensitive actions
• Unauthenticated, login or logout CSRF
• Attacks that need a man-in-the-middle position or physical access to a user’s device
• Content spoofing and text injection without a way to modify HTML or CSS
• Email spoofing
• Missing DNSSEC, CAA or CSP headers
• Missing Secure or HttpOnly flags on non-sensitive cookies
• Dead links

What we promise

• We’ll reply within 3 business days with our assessment and an expected fix date.
• We’ll keep you updated until the issue is resolved.
• We’ll keep your report confidential.

Good-faith reports and bounties

This section applies only to authorized parties: Comp AI customers using their own accounts, and anyone we’ve given explicit written consent to test Comp AI.

If you’re an authorized party and you report an issue to us promptly and in good faith, we won’t take action against you for reporting it. This doesn’t authorize any testing beyond what we’ve agreed to in writing.

We may offer a bounty for a report from an authorized party. Whether we offer one, and how much, is entirely at our discretion. Before we pay a bounty, we’ll verify your identity and address, confirm on a video call that you’re an authorized party, and run any other checks we need. We don’t pay bounties to anyone else.

Confidentiality

Keep any security issue you report to us confidential. Don’t share it publicly or with anyone else without our written consent.

Thank you for helping keep Comp AI and our customers safe.