Vulnerability Disclosure Policy

1. PURPOSE

Saees welcomes good-faith reports of security vulnerabilities that may affect Saees websites, APIs, applications, or Services.

2. REPORTING CHANNEL

Send reports to security@saees.ai. Include the affected product, technical description, reproduction steps, impact assessment, evidence, and a safe contact method. Do not include live credentials or unnecessary Personal Data.

3. GOOD-FAITH RESEARCH

Researchers should avoid privacy violations, service disruption, data destruction, unauthorized access to Customer workspaces, social engineering, denial-of-service testing, and automated high-volume testing.

4. RESPONSE

Saees will use commercially reasonable efforts to acknowledge a report, validate the issue, assess severity, coordinate remediation, and communicate when appropriate. Response timing may vary with complexity, risk, evidence, and third-party involvement.

5. SAFE HARBOR

Saees will not pursue legal action against a researcher for research that is authorized by this policy, conducted in good faith, and does not violate applicable law or access data beyond what is reasonably necessary to demonstrate the issue.

6. DISCLOSURE

Researchers should not publicly disclose a vulnerability before Saees has had a reasonable opportunity to investigate and remediate it. Saees may coordinate a disclosure timeline with the researcher.

7. EXCLUSIONS

Reports involving unsupported third-party services, social engineering, spam, weak passwords without a demonstrable platform defect, missing security headers without impact, or rate-limit observations without meaningful risk may fall outside this policy.

8. CONTACT

security@saees.ai

Saees LLC, 4730 University Wy NE, Seattle, WA 98105