MetisGrid ("MetisGrid") welcomes reports of security vulnerabilities in MetisForge and the metisgrid.com website from security researchers and Users. This policy sets out how to report, what is in scope, and what MetisGrid commits to in return.
1. Reporting
Send reports to security@metisgrid.com. Include:
- the affected URL, endpoint or component;
- steps to reproduce, with request and response details where relevant;
- the impact you believe the issue has; and
- any proof-of-concept material. Do not include Customer Content belonging to others.
MetisGrid will acknowledge receipt within 3 business days, provide an initial assessment within 10 business days, and keep you informed of remediation progress.
2. Scope
In scope:
- app.metisgrid.com and all subdomains of metisgrid.com operated by MetisGrid;
- the MetisForge web application and its APIs;
- MetisGrid-operated edge functions.
Out of scope:
- infrastructure operated by subprocessors (Supabase, cloud providers, AI providers); report those to the respective provider;
- denial-of-service, volumetric or resource-exhaustion testing;
- social engineering of MetisGrid personnel or Customers;
- physical attacks;
- findings from automated scanners without a demonstrated impact;
- missing security headers, SPF/DKIM/DMARC configuration, or TLS configuration without a demonstrated exploit;
- issues requiring a compromised or rooted device;
- prompt-injection findings that only affect the researcher's own organization and content.
3. Rules of Engagement
While testing you must:
- test only against accounts and organizations you own or are expressly authorized to test;
- stop and report immediately if you encounter another Customer's data, and not access, copy or retain it;
- not exfiltrate data beyond what is needed to demonstrate the issue;
- not modify or delete data you do not own;
- not degrade Service availability;
- comply with applicable law.
Testing that follows this policy is authorized under Section 7 of the Terms of Service. Testing that does not follow it is not authorized.
4. MetisGrid Commitments
For reports made in good faith under this policy, MetisGrid will:
- not pursue legal action against you;
- work with you to understand and resolve the issue;
- credit you publicly if you wish, once the issue is remediated;
- remediate confirmed critical and high-severity issues as priorities, targeting 7 and 30 days respectively.
MetisGrid does not currently operate a paid bug-bounty program.
5. Disclosure
Please allow MetisGrid 90 days from acknowledgment to remediate before public disclosure. MetisGrid will coordinate disclosure timing with you and may request a reasonable extension for complex issues. MetisGrid will not disclose your identity without your consent.