Vulnerability Disclosure Policy

Tonion takes the security of our platform and the data of our customers seriously. We welcome responsible disclosure from security researchers, customers, and the broader security community. This Vulnerability Disclosure Policy (“Policy”) describes how to report security vulnerabilities to us, what you can expect from us in return, and the boundaries within which security research on our systems is permitted.

1. Scope

1.1 In-Scope Systems

The following assets are in scope for security research:

• Web application - tonion.ai and all subdomains serving the Tonion platform
• Public API - REST and WebSocket endpoints documented at https://api.tonion.ai/swagger-ui/index.html
• Authentication infrastructure - login, session management, OAuth flows, and token handling
• Agent policy engine - policy evaluation endpoints and action interception APIs
• SDKs and client libraries - official Tonion SDKs published under the @tonion npm namespace or equivalent

1.2 Out-of-Scope Systems

The following are explicitly out of scope. Testing against these systems may result in legal action:

• Third-party services and infrastructure we do not own or operate
• Customer-managed deployments or self-hosted instances
• Social engineering attacks targeting Tonion employees or contractors
• Physical security of Tonion facilities or hardware
• Denial-of-service (DoS/DDoS) attacks of any kind
• Spam, phishing campaigns, or email abuse
• Automated scanning that generates excessive load on production systems

2. Reporting a Vulnerability

2.1 How to Report

Submit your findings by email to security@tonion.ai. To help us triage and reproduce the issue quickly, please include:

• Vulnerability type - e.g., XSS, IDOR, SQL injection, broken authentication
• Affected asset - URL, endpoint, SDK method, or component name
• Step-by-step reproduction instructions - including HTTP requests, payloads, and any required preconditions
• Proof-of-concept - screenshots, screen recordings, or a minimal exploit demonstrating impact
• Impact assessment - what data or functionality could be affected and by whom
• Your contact information - name or handle and a preferred email address for follow-up

2.2 Encryption

If your report contains sensitive details such as working exploits or credentials, we encourage you to encrypt your email using our PGP key. Request it by emailing security@tonion.ai with subject line “PGP Key Request” before sending your full report.

3. Our Commitments to You

When you submit a valid report in accordance with this Policy, Tonion commits to:

• Acknowledgement within 3 business days - we will confirm receipt of your report and assign it an internal tracking ID
• Initial triage within 10 business days - we will assess severity, confirm reproducibility, and communicate our initial findings
• Regular status updates - we will keep you informed of remediation progress at least every 30 days until the issue is resolved
• Transparent resolution timeline - we will provide an estimated fix date once the issue is confirmed and scoped
• Credit and recognition - with your permission, we will acknowledge your contribution publicly in our Security Hall of Fame
• Coordinated disclosure - we will work with you on public disclosure timing, targeting a 90-day window from confirmation unless extended by mutual agreement

4. Safe Harbor

Tonion will not pursue civil or criminal action against researchers who discover and report security vulnerabilities in good faith and in compliance with this Policy. We consider responsible security research to be a valuable contribution to the security of our platform and our customers.

To qualify for safe harbor, you must:

• Act in good faith and avoid harm to Tonion, its customers, or any third party
• Not access, modify, or exfiltrate customer data beyond what is minimally necessary to demonstrate the vulnerability
• Not disclose the vulnerability publicly before Tonion has had a reasonable opportunity to remediate it
• Not use the vulnerability for personal gain or to benefit any third party
• Cease testing and notify us immediately upon discovering any vulnerability that may affect customer data
• Comply with all applicable Indian and international laws during your research

5. Severity Classification

We use the Common Vulnerability Scoring System (CVSS v3.1) as a baseline for severity, supplemented by our own assessment of business impact and exploitability in our environment.

• Critical (CVSS 9.0–10.0) - Remote code execution, full authentication bypass, mass customer data exfiltration. Target remediation: 7 days.
• High (CVSS 7.0–8.9) - Privilege escalation, significant data exposure, broken access controls affecting multiple customers. Target remediation: 30 days.
• Medium (CVSS 4.0–6.9) - Stored XSS, CSRF with meaningful impact, information disclosure of non-sensitive data. Target remediation: 60 days.
• Low (CVSS 0.1–3.9) - Reflected XSS requiring user interaction, minor information leakage, cosmetic security issues. Target remediation: 90 days.
• Informational - Best-practice recommendations, missing security headers, or findings with no direct exploitable impact. Addressed at our discretion.

6. Out-of-Scope Vulnerability Classes

The following vulnerability types are considered out of scope for this Policy. Reports covering only these issues will be acknowledged but will not result in credit or recognition:

• Missing HTTP security headers (e.g., X-Frame-Options, Content-Security-Policy) without a demonstrated exploit
• Software version disclosure or banner grabbing with no associated exploitable vulnerability
• Clickjacking on pages that do not perform sensitive actions or require authentication
• SSL/TLS cipher suite issues that do not represent a practical attack vector
• Self-XSS or issues requiring full control of the victim’s browser
• Rate limiting on non-sensitive, non-authenticated endpoints
• Vulnerabilities in outdated browsers or operating systems that are no longer supported
• Login or registration page username or email enumeration without demonstrating elevated risk
• Theoretical vulnerabilities without a working proof of concept
• Findings from automated scanners submitted without manual validation

7. Rules of Engagement

When conducting security research on in-scope systems, you must:

• Use only test accounts you own or have explicit permission to test. Do not attempt to access other users’ accounts or data.
• Minimise impact - do not perform actions that could degrade availability, corrupt data, or affect other users.
• Avoid automated, high-volume scanning that places excessive load on production infrastructure.
• Do not store, share, or transmit any customer data you encounter during testing.
• Stop testing immediately if you unexpectedly access data belonging to another customer and notify us right away.
• Do not publicly disclose details of the vulnerability until Tonion has confirmed remediation or the 90-day coordinated disclosure window has passed.

8. Coordinated Disclosure

Tonion follows a coordinated disclosure model. We ask that researchers refrain from publicly disclosing vulnerability details for a period of 90 days from the date we confirm the issue, to allow us sufficient time to develop, test, and deploy a fix. We will work collaboratively with you on disclosure timing. If extenuating circumstances require an extension, we will request it in writing with a justified new date. If we fail to remediate within the agreed timeline without communication, researchers may proceed with disclosure at their discretion after providing at least 7 days’ advance notice.

9. Recognition

Tonion does not currently operate a paid bug bounty programme. However, we value the contributions of the security community and recognise valid, in-scope reports in the following ways:

• Security Hall of Fame - public acknowledgement on our website (with your consent)
• Written letter of recognition - available upon request for researchers who report critical or high severity findings
• Direct communication with our engineering team - for impactful findings, we invite researchers to a technical debrief call

We reserve the right to introduce a formal bug bounty programme in the future, at which point eligible past reporters may be considered for retroactive recognition at our discretion.

10. Policy Updates

Tonion reserves the right to update this Policy at any time. Material changes will be reflected with an updated effective date at the top of this page. We encourage researchers to review this Policy periodically. Continued engagement with our vulnerability disclosure programme following any update constitutes acceptance of the revised Policy.

11. Legal

This Policy does not grant any rights beyond those expressly stated herein, nor does it constitute a waiver of any of Tonion’s legal rights. Nothing in this Policy prevents Tonion from taking action against any person who accesses our systems without authorisation, causes damage, or acts in bad faith, regardless of whether a vulnerability report is subsequently submitted. All research activities must comply with applicable Indian law, including the Information Technology Act, 2000 and any amendments thereto.