Vulnerability Disclosure Policy

Reporting a vulnerability

If you believe you have found a vulnerability in one of Mark AI's services, you can report it to security@markcopy.ai.

To help with the analysis of your report, please include:

• a description of the vulnerability and its potential impact;
• the affected URL, screen or API;
• steps to reproduce it (screenshots or a proof of concept are welcome);
• your contact details, if you would like to be contacted.

Scope

This policy covers the Mark AI platform (app.markcopy.ai), its APIs and the websites operated by Mark AI under the markcopy.ai domain.

Out of scope:

• services of our providers and subprocessors, which should be reported to them directly;
• denial of service, social engineering, phishing and physical testing;
• reports from automated tools without a demonstrated real-world impact;
• missing best practices without a demonstrated exploit (HTTP headers, SPF, DKIM, DMARC, cookie attributes, clickjacking on pages without sensitive actions);
• spam and missing rate limiting on public forms.

Rules

• Only use your own test accounts and do not access other users' data;
• do not modify, delete or keep any data that does not belong to you;
• do not take any action that could degrade the availability of the service;
• do not disclose the vulnerability publicly without Mark AI's prior agreement.

Mark AI does not run a bug bounty program: no payment is made for reports.