Third Eye Cyborg, LLC

    Vulnerability Disclosure Policy

    Last updated: October 14, 2026 | Effective: May 24, 2026

    Vulnerability Disclosure Policy

    Effective May 24, 2026 Third Eye Cyborg, LLC Last updated October 14, 2026

    1. Purpose

    Third Eye Cyborg, LLC welcomes reports from security researchers who help us keep Ascended Social safe. This Vulnerability Disclosure Policy ("VDP") describes the systems and research types covered, how to submit a report, and what you can expect from us.

    2. Scope

    • ascended.social and subdomains we operate.
    • The Ascended Social web app and APIs at our official domains.
    • The Ascended Social mobile app published by Third Eye Cyborg, LLC.
    • The desktop app published by Third Eye Cyborg, LLC.
    Out of scope: third-party services (e.g., Polar, Cloudflare, Neon, App Store, Play Store), social engineering of us or our service providers, physical attacks, denial-of-service, and findings that require rooted / jailbroken devices unless they cross a privilege boundary.

    3. Safe-harbour commitment

    We will not pursue or support legal action against researchers who, in good faith, comply with this policy. Specifically:

    • You make a good-faith effort to avoid privacy violations, destruction of data, and interruption or degradation of the Service.
    • You only use accounts you own or accounts you have explicit permission to test.
    • You do not exfiltrate, retain, or disclose user data beyond the minimum necessary to demonstrate the issue.
    • You give us reasonable time to investigate and remediate before public disclosure.
    • You comply with all applicable laws.

    4. How to report

    Email security@thirdeyecyborg.com. Please don't send sensitive details until we reply with a secure way to share them. Please include reproduction steps, impact, and any PoC code. Do not include unredacted user data.

    5. What to expect

    • Acknowledgement within 3 business days.
    • We aim to give a triage update within 10 business days.
    • Remediation timelines proportional to severity.
    • If you'd like, we can credit you publicly after the issue is fixed.

    6. Bounty

    We don't run a paid bug-bounty program, and we don't offer rewards for reports.

    Questions: security@thirdeyecyborg.com

    Powered by PolicyForge