Vulnerability Disclosure Policy

Operator: Adaptive Agility LLC ("Sutradhar", "we", "us", "our"). Security contact: security@adaptiveagility.com

1. Introduction

Adaptive Agility LLC is dedicated to preserving the security of the data Sutradhar stewards, and to preventing unauthorized disclosure of information. This policy provides security researchers with instructions for conducting vulnerability discovery activities and explains how to report discovered vulnerabilities to us. It defines which systems and types of activity are covered, how to send vulnerability reports, and how long we ask you to wait before public disclosure.

2. Guidelines

We request that you:

• Notify us as soon as possible after you discover a real or potential security issue.
• Provide us a reasonable amount of time to resolve the issue before you disclose it publicly. Our committed remediation targets are 72 hours for critical issues, 7 days for high, and 30 days for medium; we ask that public disclosure follow remediation, coordinated with us.
• Make every effort to avoid privacy violations, degradation of user experience, disruption to production systems, and destruction or manipulation of data. Sutradhar stewards read-only access to real users' email, calendar, and document metadata, so privacy caution matters especially here.
• Only use exploits to the extent necessary to confirm a vulnerability's presence. Do not use an exploit to compromise or exfiltrate data, establish command-line access or persistence, or pivot to other systems.
• Once you have established that a vulnerability exists, or encounter any sensitive data (including personal data or another user's information), stop your test, notify us immediately, and keep the data strictly confidential.
• Test only against accounts you own or accounts you have explicit permission to use.
• Do not submit a high volume of low-quality reports.

3. Authorization

Security research carried out in conformity with this policy is deemed authorized. We will work with you to swiftly understand and resolve the issue, and Adaptive Agility LLC will not recommend or pursue legal action in connection with research conducted in good faith within this policy.

4. Scope

This policy applies to the following systems and services:

• sutradhar.io (this public website)
• app.sutradhar.io (the Sutradhar web application, including its installable PWA form)
• api.sutradhar.io (the Sutradhar API)

Any service not explicitly listed above is out of scope and is not authorized for testing. Vulnerabilities discovered in third-party platforms Sutradhar builds on (including Google, Microsoft, Anthropic, Render, GoDaddy, and Cloudflare) are not covered by this policy and should be reported directly to the relevant vendor under their own disclosure policy. If you are unsure whether a system or endpoint is in scope, email us at security@adaptiveagility.com before beginning.

5. Types of testing not authorized

• Network denial of service (DoS or DDoS) tests, or any volumetric testing intended to degrade availability. (The API rate-limits aggressively; sustained automated traffic will be throttled.)
• Physical testing (office access, tailgating), social engineering (phishing, vishing), or any other non-technical vulnerability testing.
• Testing against other users' accounts or data without their explicit permission.

6. Reporting a vulnerability

To report a security flaw, email security@adaptiveagility.com. We will acknowledge receipt of your report within 2 business days and keep you updated on our progress. Reports may be submitted anonymously.

7. What to include

To help us process and react to your report, we recommend including:

• A description of the vulnerability
• Where it was discovered (URL, endpoint, or component)
• Its potential impact
• Steps required to reproduce it (scripts and screenshots welcome)

If possible, please provide your report in English.

8. Our commitment

If you choose to share your contact information, we promise to communicate with you in a transparent and timely manner. We will acknowledge receipt of your report within 2 business days, keep you informed on vulnerability confirmation and remediation to the best of our capabilities, and credit good-faith researchers on request. We welcome discussion of any concerns and are willing to engage in dialogue.