Vulnerability Disclosure Policy

Reporting a security vulnerability

AIMS Insights welcomes reports of security vulnerabilities in MIMIR and our website. If you believe you have found one, please tell us so we can fix it.

Email: security@aimsinsights.com

Please include:

• what you found, and where (URL, app screen, or API endpoint);
• steps to reproduce it;
• the impact you believe it has;
• your name or handle, if you would like credit.

In scope

• aimsinsights.com and its subdomains
• The MIMIR API (api.mimir.aimsinsights.com)
• The MIMIR iOS and Android apps

Out of scope

• Denial-of-service or load testing
• Social engineering or phishing of AIMS staff or users
• Physical attacks
• Findings in third-party services (e.g. AWS, Google, Apple); please report those to the provider
• Automated scanner output without a demonstrated impact

Rules for testing

• Only use accounts you own or have permission to use. Do not access, change, or delete other users' data; if you encounter it, stop and tell us.
• Do not disrupt the service for other users.
• Give us reasonable time to fix the issue before telling anyone else.

What we commit to

• Acknowledge your report within 5 working days.
• Tell you our assessment within 10 working days.
• Keep you informed until it is fixed, and credit you if you wish.
• Not pursue legal action against anyone who reports a vulnerability in good faith and follows this policy.

We do not currently run a paid bug bounty.