Как сообщить о проблеме безопасности.

This policy covers security vulnerabilities in the Prism service at prismlens.net, including the web application, API, and any mobile clients we release. It does not cover third-party services (Supabase, Vercel, Anthropic, OpenAI, Stripe, Resend) — report issues in those directly to the vendor.

• ·Authentication and authorisation flaws (access control bypasses, session handling, privilege escalation).
• ·Data exposure or leakage (other users’ entries, embeddings, analysis, or personal data visible without authorisation).
• ·Injection flaws (SQL, template, command, prompt injection that leaks data across users).
• ·Remote code execution.
• ·Server-side request forgery (SSRF) or other infrastructure risks.
• ·Logic flaws that allow free access to paid features, bypass of rate limits, or financial loss.
• ·Supply-chain risks specific to Prism’s deployment.

• ·Third-party issues in Supabase, Vercel, Anthropic, OpenAI, Stripe, Resend — report to the vendor.
• ·Denial of service, volumetric attacks, or physical attacks.
• ·Social-engineering attacks against Prism staff.
• ·Self-XSS requiring the user to paste code into their own browser.
• ·Missing security headers with no demonstrable impact.
• ·Clickjacking on pages with no sensitive action.
• ·Issues requiring an already-compromised device or root/jailbreak.
• ·CSRF on endpoints with no security impact.
• ·Rate limiting / brute force without credential-valid impact.
• ·Reports generated entirely by automated scanners with no manual verification.

Электронная почта security@prismlens.net с:

• ·A clear description of the issue.
• ·Steps to reproduce, or a proof-of-concept.
• ·Your assessment of impact (who is affected, how).
• ·Your contact details (optional) if you want attribution or a reply.

• ·Acknowledge receipt within 3 business days.
• ·Triage and respond with our initial assessment within 7 business days.
• ·Keep you informed through remediation.
• ·Not take legal action against good-faith research conducted within this policy, provided you avoid accessing or exfiltrating other users’ data beyond the minimum needed to demonstrate the issue, do not degrade service availability, give us a reasonable window (default 90 days) before public disclosure, and comply with applicable law.

• ·Don’t test against real users’ data. Create a test account.
• ·Don’t use social engineering against Prism’s founders, staff, or users.
• ·Don’t exfiltrate data beyond what’s needed to prove the issue.
• ·Don’t publicly disclose before we’ve had a reasonable window to respond and remediate.
• ·Report in English or Arabic.

Prism в настоящее время не работает по программе денежного вознаграждения. За значительные проблемы мы дадим вам публичное признание (с вашего разрешения), упомянем вас в записи журнала изменений и отправим мерч Prism, если есть в наличии. Для нас приоритет — скорость исправления, а не бюджет вознаграждения — мы вернёмся к этому вопросу по мере роста.

В максимально возможной степени ваше добросовестное исследование в соответствии с этой политикой:

• ·Is authorised by Prism and does not violate the Prism Terms of Service.
• ·Will not be grounds for civil or criminal action by Prism under applicable computer-misuse laws.
• ·Will not result in a complaint to your employer, regulator, or law enforcement.

Эта безопасная гавань — наше обязательство и не гарантирует, что третьи стороны (платёжные процессоры, провайдеры инфраструктуры) будут придерживаться того же взгляда. Если вы сомневаетесь, спросите нас перед тестированием.

• ·Security reports: security@prismlens.net
• ·General support: support@prismlens.net
• ·Privacy / DPO: privacy@prismlens.net · dpo@prismlens.net