Vulnerability Disclosure Policy

If you believe you have found a security vulnerability in Elios, please tell us. This policy of Elios Superintelligence, Inc. (“Elios”) explains how to report it, what research we authorize, and how we will work with you.

For general product support, write to support@elios.ai. For account abuse or unwanted calls and messages, write to abuse@elios.ai. Those reports are separate from vulnerability disclosure.

#1. Report a vulnerability

Send your report to security@elios.ai. If your evidence contains secrets or sensitive information, first ask us for a secure transfer method. Do not include live credentials or unnecessary personal data in an ordinary email.

A useful report includes:

• The affected Elios asset and the date and time of the observation.
• A clear description of the issue and its potential impact.
• Minimal steps that let us reproduce it safely, using test accounts and test data where possible.
• Relevant request identifiers, screenshots, or a small proof of concept with sensitive information removed.
• Whether you have already disclosed the issue to anyone else.
• A way to contact you, if you would like a response or further coordination.

We accept reports without a proposed fix. Please report a plausible issue even if you cannot fully prove its impact without risking harm.

#2. Authorized scope

The following assets are in scope only to the extent that Elios owns them or has authority to authorize testing:

An Elios-branded link, DNS record, embedded service, customer workload, or third-party integration is not automatically in scope. This policy does not authorize testing a carrier, cloud provider, payment processor, identity provider, customer application, or another person’s account. If you are unsure whether an asset or method is authorized, ask us before testing it.

#3. Research rules

Use the smallest amount of testing needed to demonstrate an issue. Use your own accounts and synthetic data. Keep request volumes low enough to avoid degrading service. Stop when you have enough evidence for us to investigate.

Do not:

• Access, copy, change, or delete another person’s data, except for the minimal inadvertent access needed to recognize a vulnerability. If that occurs, stop, report it, and do not retain or share the data beyond what is necessary for secure reporting.
• Continue exploiting an issue, expand access, maintain persistence, or use a finding to reach unrelated systems.
• Conduct denial-of-service, destructive, load, or resource-exhaustion testing without separate written approval.
• Use credential stuffing, phishing, social engineering, physical intrusion, or threats.
• Place calls or send messages to people or numbers you do not control for the purpose of testing.
• Run a test that causes unwanted charges, affects customer communications, or interferes with a live workload.
• Demand payment in exchange for withholding a report, deleting data, or stopping harmful activity.

If you unintentionally cross a boundary, stop promptly and explain what happened. A good-faith mistake reported promptly will be assessed in that context.

#4. Authorization and safe harbor

Elios authorizes good-faith security research that follows this policy on the assets and within the limits described above. For that research, Elios will not pursue or support legal action based on a claim that the research violated an Elios restriction on unauthorized access, security testing, or circumvention. To the extent Elios has authority to do so, Elios waives conflicting restrictions in its Terms of Service solely for that authorized research.

If a third party brings a legal claim against you because of research conducted under this policy, we will, if asked and legally permitted, state that your research was authorized by Elios. We cannot authorize activity against systems we do not control, bind a third party or public authority, or waive another person’s rights. This policy does not authorize unlawful conduct beyond the authority Elios is able to grant.

We assess good faith by the purpose, conduct, and prompt reporting of the research. We will not withdraw this authorization retroactively for research that complied with the version of the policy in effect when it was performed.

#5. Our response and coordinated disclosure

We will review reports submitted through the designated channel, investigate credible issues, and work with the reporter where further information is needed. We may share a report with relevant service providers or advisers to investigate and remediate it, limiting disclosure as appropriate. We do not promise a fixed response or remediation time.

Please give us a reasonable opportunity to investigate and address a vulnerability before publishing details that could place users at risk. We will discuss a reasonable disclosure timeline with you, including any dependencies or coordinated vendor disclosure. This request is not a demand for indefinite secrecy. If we cannot agree on a timeline, explain your proposed date so that we can plan protective measures and communicate with affected parties.

Do not publish personal data, secrets, or instructions that unnecessarily expose affected users. We will ask before publicly crediting you by name or linking to your profile.

#6. Rewards and policy changes

This disclosure policy is not a paid bug bounty program and does not promise a payment or other reward. Any separately offered program will state its own scope and terms.

We may update this policy as our services change. The current scope applies to new research after an update; authorized past research remains covered as described above.