Responsible disclosure policy

Security is central to what we do, and we welcome reports from researchers who find vulnerabilities in our systems. If you believe you have found a security issue, please tell us privately and give us a reasonable chance to fix it before you disclose it. We will work with you openly and in good faith.

In scope: this website and its subdomains operated by Modern Influence, including the Orion AI access gate and invitation-only area, our forms and their back-end endpoints, and our published /.well-known/security.txt.

Vulnerabilities in the Orion AI software itself are also welcome. If you find an issue in a deployment of the platform run by another organisation under its own brand, report it to that organisation; you may also tell us so that we can fix the underlying software.

Out of scope: services operated by third parties (for example our hosting, email, CRM or analytics providers), which should be reported to them; social media accounts; physical attacks on our offices or staff; social engineering or phishing of our staff or clients; and denial-of-service or load testing.

We generally do not accept reports of: findings from automated scanners without a demonstrated impact; missing security headers or cookie flags without a practical exploit; clickjacking on pages with no sensitive actions; self-XSS; email configuration best practice such as SPF, DKIM or DMARC policy; rate limiting on non-sensitive endpoints; issues that affect only outdated or unsupported browsers; and version disclosure without a related vulnerability.

Test only against accounts and data you own or have explicit permission to use. Do not access, modify, delete or keep data that belongs to others; if you encounter personal or confidential data, stop, do not copy it, and tell us.

Do not try to guess, brute-force or share Orion AI access codes. Our rate limits and lockouts are in scope only to the extent you can show a bypass with minimal requests. If you need an access code to test the Orion area, ask us and we will issue one for testing.

Use the minimum testing needed to demonstrate an issue. Do not degrade the website for other users, run high-volume automated scans, or leave persistent changes or backdoors.

Keep the details confidential until we have fixed the issue or agreed a disclosure date with you.

If you act in good faith and follow this policy, we will consider your research authorised, we will not pursue legal action against you, and we will not report you to law enforcement for that research. If a third party takes legal action against you for research that followed this policy, we will make it known that your activity was authorised by us.

This safe harbour cannot authorise testing of systems we do not own, and it does not apply if you breach this policy, act with malicious intent, extort or threaten us, or access more data than needed to show the issue.

Email [email protected]. Please include: a description of the issue and its potential impact; the affected URL, endpoint or component; step-by-step instructions to reproduce it, with any proof-of-concept code, requests or screenshots; and how you would like to be credited, if at all.

If you want to encrypt your report, ask for our encryption key in a first email without vulnerability details, or use the key referenced in our security.txt file when it is published.

You may report anonymously, but we will then be unable to keep you updated.

Acknowledgement of your report within 3 business days.

An initial assessment, including whether we can reproduce the issue and its severity, within 10 business days.

Updates at least every 14 days until the issue is resolved.

Fix targets from confirmation: critical issues within 7 days, high within 30 days, medium within 90 days, and low as part of regular maintenance. We will tell you if an issue needs longer and why.

Coordinated disclosure: we ask that you wait until a fix is in place, or 90 days from your report, whichever comes first, before publishing, and we will agree a date with you where we can.

We do not run a paid bug bounty programme and we do not pay rewards for reports. With your permission, we will thank you publicly by name or handle once the issue is fixed.