How to report a security issue.

This policy covers security vulnerabilities in the Prism service at prismlens.net, including the web application, API, and any mobile clients we release. It does not cover third-party services (Supabase, Vercel, Anthropic, OpenAI, Stripe, Resend) — report issues in those directly to the vendor.

• ·Authentication and authorisation flaws (access control bypasses, session handling, privilege escalation).
• ·Data exposure or leakage (other users’ entries, embeddings, analysis, or personal data visible without authorisation).
• ·Injection flaws (SQL, template, command, prompt injection that leaks data across users).
• ·Remote code execution.
• ·Server-side request forgery (SSRF) or other infrastructure risks.
• ·Logic flaws that allow free access to paid features, bypass of rate limits, or financial loss.
• ·Supply-chain risks specific to Prism’s deployment.

• ·Third-party issues in Supabase, Vercel, Anthropic, OpenAI, Stripe, Resend — report to the vendor.
• ·Denial of service, volumetric attacks, or physical attacks.
• ·Social-engineering attacks against Prism staff.
• ·Self-XSS requiring the user to paste code into their own browser.
• ·Missing security headers with no demonstrable impact.
• ·Clickjacking on pages with no sensitive action.
• ·Issues requiring an already-compromised device or root/jailbreak.
• ·CSRF on endpoints with no security impact.
• ·Rate limiting / brute force without credential-valid impact.
• ·Reports generated entirely by automated scanners with no manual verification.

Email security@prismlens.net with:

• ·A clear description of the issue.
• ·Steps to reproduce, or a proof-of-concept.
• ·Your assessment of impact (who is affected, how).
• ·Your contact details (optional) if you want attribution or a reply.

• ·Acknowledge receipt within 3 business days.
• ·Triage and respond with our initial assessment within 7 business days.
• ·Keep you informed through remediation.
• ·Not take legal action against good-faith research conducted within this policy, provided you avoid accessing or exfiltrating other users’ data beyond the minimum needed to demonstrate the issue, do not degrade service availability, give us a reasonable window (default 90 days) before public disclosure, and comply with applicable law.

• ·Don’t test against real users’ data. Create a test account.
• ·Don’t use social engineering against Prism’s founders, staff, or users.
• ·Don’t exfiltrate data beyond what’s needed to prove the issue.
• ·Don’t publicly disclose before we’ve had a reasonable window to respond and remediate.
• ·Report in English or Arabic.

Prism does not currently operate a cash bounty programme. For significant issues we'll acknowledge publicly (with your permission), credit you in a changelog entry, and issue Prism swag where available. Our priority is remediation speed, not a bounty budget — we will revisit as we grow.

To the fullest extent we can offer, your good-faith research under this policy:

• ·Is authorised by Prism and does not violate the Prism Terms of Service.
• ·Will not be grounds for civil or criminal action by Prism under applicable computer-misuse laws.
• ·Will not result in a complaint to your employer, regulator, or law enforcement.

이 안전 항구는 우리의 약속이며 제3자(결제 처리업체, 인프라 제공업체)가 동일한 견해를 취할 것임을 보장하지 않습니다. 의심스러우신 경우 테스트하기 전에 저희에게 문의해 주세요.

• ·Security reports: security@prismlens.net
• ·General support: support@prismlens.net
• ·Privacy / DPO: privacy@prismlens.net · dpo@prismlens.net