Security Policy

1. How to report a vulnerability

In Short: Email us privately; do not post the details publicly.

Email support@globalvextraai.com with the subject line ‘Security: [a short description]’. Please do not describe the issue anywhere public — on social media, a forum, or a public issue tracker — until we have fixed it, because that puts other users at risk.

2. What to include

In Short: Enough detail for us to reproduce it.

• What the vulnerability is and what an attacker could do with it.
• Steps to reproduce it, such as the URLs, requests or inputs involved.
• The browser, device or environment you used.
• Any proof-of-concept, screenshots or logs.
• How you would like to be credited, or that you would prefer to stay anonymous.

3. What to expect from us

In Short: A reply within 48 hours, an assessment within 7 days, and regular updates.

• Acknowledgement within 48 hours, with a reference for your report.
• An initial assessment within 7 days of how severe the issue is and whether we can reproduce it.
• Updates at least every 14 days while we work on an accepted report.
• A fix, usually within 14 days for critical issues and within 90 days for less severe ones. We will tell you the expected timeline once we have assessed the report.
• Credit, with your permission, once the fix is live. We ask you to keep the issue private until then.

4. What is in scope

In Short: The Global Vextra AI website, app and its APIs.

• The website and app at www.globalvextraai.com.
• Sign-in, sessions and account access.
• Billing, plans and minute allowances.
• Video upload, processing, storage and download.
• Access controls between accounts — for example, one user reaching another user’s videos or clips.
• The APIs the app uses.
• Common web vulnerabilities such as cross-site scripting, request forgery, injection and server-side request forgery.

5. What is out of scope

In Short: Other companies' services, attacks on people, and reports with no real impact.

• Vulnerabilities in services run by other companies that we use, such as Cloudflare, Google, Vercel, MongoDB or Stripe — please report those to that company.
• Issues that need physical access to someone’s device.
• Social engineering or phishing of our team or our users.
• Denial-of-service attacks or high-volume traffic.
• Missing security headers with no way to exploit them.
• Warnings that only affect very old browsers.
• ‘Self-XSS’ that needs a victim to paste code into their own browser.
• Automated scanner output without any analysis.

6. Testing rules

In Short: Use your own accounts, and stop once you have shown the issue.

• Test only with accounts you own or have permission to use. Never access, change or delete another user’s data.
• Do no more than you need to show the issue exists. If you reach someone else’s data by accident, stop, do not keep a copy, and tell us.
• Do not degrade the Services for other users, for example with load testing or spam.
• If you are unsure whether something is allowed, email us first.

7. Safe harbour

In Short: We will not take legal action against good-faith research that follows this policy.

If you make a good-faith effort to follow this policy, we will consider your research authorised, we will not take legal action against you or ask law enforcement to, and we will work with you to understand and fix the issue. This applies when you:

• follow the testing rules above;
• avoid privacy violations, destroying data and interrupting the Services;
• report the issue to us promptly; and
• keep it private until we have fixed it.

We cannot authorise testing of services run by other companies, and this safe harbour does not cover them.

8. Supported versions

In Short: Only the live version of the Services.

The Services are updated continuously, and we support and fix only the version that is live. Please test against it.

9. Contact

In Short: Email us, or write to us.

Send security reports and questions about this policy to support@globalvextraai.com, or write to us at:

Global Vextra AI Ltd
Company number SC889787
5 South Charlotte Street
Edinburgh
EH2 4AN
Scotland, United Kingdom
support@globalvextraai.com