Security & Responsible Disclosure

1. Our Commitment to Security

At SpAIder, we take the security of our Service and the privacy of our users seriously. We appreciate the security research community's efforts to help keep our users safe. This policy outlines how to report security vulnerabilities and what to expect from us.

2. Scope

This policy applies to security vulnerabilities in:

• SpAIder web application (spaider.dev)
• SpAIder APIs and endpoints
• SpAIder subdomains (*.spaider.dev)
• SpAIder mobile applications (if applicable)

2.1 Out of Scope

The following are NOT covered by this policy:

• Third-party services we use (report to them directly)
• Social engineering attacks against SpAIder employees
• Physical attacks against SpAIder infrastructure
• Vulnerabilities in outdated browsers or operating systems
• Issues that require physical access to a user's device

3. Reporting a Vulnerability

3.1 What to Include

To help us understand and address the issue quickly, please include:

• Description: Clear description of the vulnerability
• Impact: Potential impact and severity assessment
• Steps to Reproduce: Detailed steps to reproduce the issue
• Proof of Concept: Screenshots, videos, or code demonstrating the issue
• Environment: Browser, OS, and other relevant details
• Your Contact: How we can reach you for follow-up

3.2 Encryption (Optional)

For sensitive vulnerabilities, you may encrypt your report using our PGP key. While not required, we appreciate the extra security. Contact us for our public key.

4. Responsible Disclosure Guidelines

To protect our users, we ask that you follow these responsible disclosure guidelines:

5. Safe Harbor

6. Our Response Process

6.1 Timeline

6.2 Communication

We'll keep you informed throughout the process and coordinate with you on public disclosure timing. We aim for transparency while protecting our users.

7. Severity Assessment

We assess vulnerability severity using industry-standard frameworks (CVSS). Priority levels:

8. Recognition

We appreciate security researchers who help keep SpAIder safe:

• We'll publicly thank you (with your permission) when we disclose the fix
• We may add you to our Security Hall of Fame
• We'll provide you with swag and recognition (when applicable)

Note: We currently do not offer a bug bounty program, but we deeply appreciate your efforts.

9. Security Best Practices

9.1 For Users

• Use a strong, unique password for your SpAIder account
• Enable two-factor authentication when available
• Don't share your account credentials
• Keep your devices and browsers up to date
• Be cautious of phishing attempts
• Report suspicious activity immediately

9.2 Our Security Measures

• End-to-end encryption for data in transit (TLS 1.3)
• Encrypted storage for sensitive data
• Regular security audits and penetration testing
• Secure authentication using NextAuth.js
• Input validation and sanitization
• Rate limiting and DDoS protection
• Regular security updates and patches
• Security monitoring and incident response

10. Incident Response

In the event of a security incident:

• We'll investigate immediately and contain the issue
• We'll notify affected users within 72 hours (as required by GDPR)
• We'll provide clear information about the incident and our response
• We'll work with authorities if criminal activity is suspected
• We'll conduct a post-incident review to prevent recurrence

11. Third-Party Security

We carefully vet our third-party providers for security:

• OpenAI, Anthropic, Meta: Enterprise API agreements with security guarantees
• Stripe: PCI DSS Level 1 compliant payment processing
• Supabase: SOC 2 Type II certified database hosting
• Vercel: Secure edge network with DDoS protection

12. Questions & Contact