Vulnerability Disclosure Policy
FalconFirst AI, Inc. · Effective 4 November 2026 · Reviewed annually
Keeping our customers’ data safe is a priority for Falcon. If you believe you have found a security vulnerability in any Falcon system, we want to hear from you. This policy explains how to report it, what is in scope, and how we will work with you.
How to report
Email security@falconfirst.ai with:
- A description of the vulnerability and where it is (URL, endpoint or component)
- Step-by-step instructions to reproduce it, including any proof-of-concept
- The potential impact, as you understand it
- Your name or handle, if you would like to be credited (optional)
Please do not share the details publicly or with others until we have confirmed the issue is fixed.
What to expect from us
| Step | Timeline |
|---|---|
| Acknowledge your report | Within 3 business days |
| Initial assessment and severity rating | Within 10 business days |
| Fix | Based on severity:Critical within 15 daysHigh within 30 daysMedium within 90 daysLow within 180 days |
| Updates | We keep you informed of progress and tell you when the issue is resolved |
Scope
In scope
- Falcon web applications and APIs on
*.falconfirst.aiand*.falconfirst.app - Falcon’s production cloud infrastructure that is reachable from the internet
Out of scope
- Denial-of-service or load testing, and any testing that degrades service for others
- Social engineering, phishing or physical attacks against Falcon staff or offices
- Spam, or issues that require a compromised user device or account
- Third-party services Falcon uses (for example Microsoft, GitHub, Auth0). Please report those to the vendor
- Reports from automated scanners without a demonstrated, exploitable impact
- Missing best-practice headers or settings with no demonstrated security impact
Rules for testing
- Only test against accounts you own or have explicit permission to use
- Do not access, modify, download or delete data that is not yours. If you encounter customer or personal data, stop and report it immediately
- Use the minimum testing needed to demonstrate the issue
- Do not run tests that could affect availability or other users
- Give us reasonable time to fix the issue before any public disclosure
Safe harbor
If you make a good-faith effort to follow this policy, Falcon will consider your research authorized, will not pursue or support legal action against you, and will work with you to understand and fix the issue quickly. If a third party takes legal action against you for activity that followed this policy, we will make it known that your actions were authorized.
Recognition
Falcon does not currently offer monetary rewards. With your permission, we are glad to publicly thank researchers who report valid issues responsibly.
Questions
Contact security@falconfirst.ai.