SECURITY VULNERABILITY DISCLOSURE POLICY

Alt+Shift+X Platform

Effective Date: June 14, 2026 | Version: 2.0

Operated by: Trust AR LLC, a West Virginia limited liability company, doing business as Alt+Shift+X 1405 Earl L. Core Rd., Morgantown, WV 26501, United States

SECTION 1 — OUR COMMITMENT

Trust AR LLC d/b/a Alt+Shift+X is committed to the security of our platform and the protection of our users' data. We welcome responsible disclosure of security vulnerabilities from the security research community.

SECTION 2 — REPORTING A VULNERABILITY

2.1 How to Report

Email: info@altshiftx.tech Subject: "Security Vulnerability Report — [Brief Description]" Encryption: Request our PGP public key if you wish to submit an encrypted report.

2.2 What to Include

Type of vulnerability (e.g., XSS, SQL injection, IDOR, authentication bypass, exposed credentials)
Affected URL, endpoint, or system component
Steps to reproduce (clear, numbered)
Proof-of-concept code or screenshots (if available)
Your assessment of potential impact
Your contact information (optional — anonymous reports accepted)

2.3 What Happens After You Report

| Milestone | Timeline | |---|---| | Acknowledgment of receipt | Within 3 business days | | Initial triage and severity assessment | Within 10 business days | | Regular progress updates | At reasonable intervals | | Resolution | As fast as possible based on severity | | Notification of resolution | When fixed (if contact info provided) |

SECTION 3 — SEVERITY CLASSIFICATION

| Severity | Description | Target Resolution | |---|---|---| | Critical | Remote code execution, authentication bypass, mass data exposure, payment system compromise | 24–72 hours | | High | Privilege escalation, significant data leakage, account takeover | 7 days | | Medium | Limited data exposure, CSRF, stored XSS, IDOR | 30 days | | Low | Information disclosure, minor misconfigurations | 90 days |

SECTION 4 — AUTHORIZED RESEARCH ACTIVITIES

The following activities are authorized under this policy:

Testing for security vulnerabilities in the Platform's publicly accessible surfaces using your own test account
Reporting vulnerabilities in third-party components used by the Platform that affect our users' security
Submitting proof-of-concept exploits to demonstrate vulnerability existence — without exploiting them against real users or real data

SECTION 5 — PROHIBITED ACTIVITIES

The following activities are not authorized and may violate the Computer Fraud and Abuse Act (CFAA), the UK Computer Misuse Act, or equivalent laws:

Accessing, modifying, deleting, or exfiltrating any user data
Conducting denial of service (DoS or DDoS) attacks or stress tests
Sending phishing emails or conducting social engineering attacks
Submitting spam or automated bulk requests
Introducing malware, backdoors, or malicious code
Disclosing vulnerability details publicly before we have had reasonable time to resolve the issue
Demanding payment as a condition of disclosure (extortion)
Testing against accounts that are not your own
Accessing production user data — all testing must use test accounts and synthetic data only

SECTION 6 — COORDINATED DISCLOSURE

Report first — Submit before disclosing publicly or to any third party.
Give us time — Allow 90 days from acknowledgment before public disclosure. Critical vulnerabilities prioritized and resolved faster.
Coordinate on timing — Notify us in advance if you wish to publish research after resolution.
Extension requests — We will request extensions with a specific reason. We will not make unreasonable requests.

We will not pursue legal action against researchers who comply with this policy and act in good faith.

SECTION 7 — SAFE HARBOR

Trust AR LLC d/b/a Alt+Shift+X will not pursue civil or criminal legal action against security researchers who:

Discover and report vulnerabilities in good faith under this policy
Make every reasonable effort to avoid privacy violations, data destruction, and Platform disruption
Conduct testing only against systems they are authorized to access
Do not exploit vulnerabilities beyond the minimum necessary to demonstrate their existence
Do not disclose vulnerability details before we have had a reasonable opportunity to remediate

This safe harbor applies exclusively to good-faith security research under this policy.

SECTION 8 — NO BUG BOUNTY (CURRENT STATUS)

Trust AR LLC d/b/a Alt+Shift+X does not currently operate a paid bug bounty program. We may establish one in the future as the Platform grows.

SECTION 9 — SCOPE

In scope:

The Alt+Shift+X web application and all publicly accessible endpoints
The Alt+Shift+X API (authenticated and unauthenticated endpoints)
Authentication, session management, and access control systems
Marketplace, checkout, and payment flows
Builder and Buyer account systems

Out of scope:

Third-party services (Stripe, PayPal, Base44) — report these to the relevant third party
Social engineering attacks against staff
Physical security
Denial of service testing
Vulnerabilities in unsupported browsers or platforms

SECTION 10 — CONTACT

Trust AR LLC d/b/a Alt+Shift+X 1405 Earl L. Core Rd., Morgantown, WV 26501, United States Email: info@altshiftx.tech Subject: "Security Vulnerability Report — [Brief Description]" For critical findings: "CRITICAL SECURITY — [Brief Description]"

Governing law: State of West Virginia, United States.

Security Vulnerability Disclosure Policy — Alt+Shift+X