Unframe Ai Vulnerability Disclosure

generated: '2026-07-21'
method: searched
probe: true
source: https://www.unframe.ai/responsible-disclosure-policy
policy:
- https://www.unframe.ai/responsible-disclosure-policy
contact:
- cybersecurity@unframe.ai
program: responsible-disclosure
bug_bounty: false
safe_harbor: true
response_target: acknowledge within 7 business days
last_updated: '2025-04-14'
scope: >-
  Any vulnerabilities in Unframe's public-facing services, applications, APIs,
  and infrastructure; only previously undisclosed, unexploited vulnerabilities;
  good-faith activity within policy guidelines.
out_of_scope:
- Clickjacking on non-sensitive pages
- Missing security headers without proven impact
- Rate limiting / brute-force protection on non-authentication endpoints
- Automated scanner reports without clear exploitability
- Third-party services Unframe uses but does not control
- Physical facilities, social engineering, phishing against staff
- Network denial of service testing
- Unframe employees' personal accounts
- Hosted services of Unframe clients
evidence:
- source: https://www.unframe.ai/responsible-disclosure-policy
  kind: responsible-disclosure-page
  keywords:
  - responsible disclosure
  - cybersecurity@unframe.ai
  - safe harbor
- source: DNS CAA iodef record for unframe.ai
  kind: dns-caa-iodef
  value: mailto:security@unframe.ai
notes: >-
  No /.well-known/security.txt is published (404). Policy page commits to legal
  safe harbor for good-faith research, acknowledgement, and optional credit. No
  public bug bounty platform (HackerOne/Bugcrowd/Intigriti) found.