Vulnerability Disclosure Policy

Ollify LLC ("Ollify," "we," "us," or "our") takes the security of our platform and the privacy of our customers seriously. We believe that working with security researchers to identify and responsibly disclose vulnerabilities makes the internet safer for everyone.

This Vulnerability Disclosure Policy ("VDP") describes how to report security vulnerabilities in Ollify's systems to us, what we commit to in return, and the legal protections we extend to researchers acting in good faith. We encourage security researchers — whether experienced professionals, students, or anyone who has discovered something that looks wrong — to report concerns to us rather than leaving them unaddressed or disclosing them publicly before we have had a chance to fix them.

1. Scope

The following table describes what is and is not within scope for this VDP. Please review carefully before beginning any security research.

2. How to Report a Vulnerability

To report a vulnerability, send an email to security@ollify.app. We handle all security reports through this channel. Please do not report vulnerabilities through our general support or legal channels.

Your report should include as much of the following as possible. More detail helps us reproduce and fix issues faster:

2.1 Encryption. If your report contains particularly sensitive details — for example, proof of access to customer data — you may request PGP encryption by emailing security@ollify.app; a published public PGP key is not yet available. Unencrypted reports are also accepted and will be handled with the same care.

2.2 Anonymous Reports. You may submit a report anonymously. However, we will not be able to provide you with updates on remediation progress or reach out with questions if something in your report is unclear. If you wish to remain anonymous but still receive updates, consider using a pseudonymous email address.

3. What Ollify Commits To

We treat all good-faith security reports seriously and commit to the following:

4. Safe Harbor

4.1 Conditions for Safe Harbor Protection. Safe harbor protections apply when the researcher:

• Reports the vulnerability to Ollify through the process described in Section 2 before any public disclosure.

• Makes a good-faith effort to avoid privacy violations, data destruction, data exfiltration, and disruption of the Service to other users.

• Limits testing to what is reasonably necessary to demonstrate the existence and impact of the vulnerability.

• Does not access, modify, exfiltrate, or retain data beyond what is minimally necessary to demonstrate the vulnerability — and deletes any data accessed as part of testing.

• Does not conduct testing that degrades the performance or availability of the Service for other users.

• Does not publicly disclose the vulnerability before the earlier of: (a) 90 days from initial report; or (b) Ollify's deployment of a fix, as described in Section 5.

• Does not extort or demand payment in exchange for not disclosing the vulnerability.

4.2 Conduct Not Covered by Safe Harbor. Safe harbor protections do not apply to:

1. (a)

   accessing, downloading, or exfiltrating production customer data beyond what is minimally necessary to demonstrate a vulnerability;

2. (b)

   intentionally destroying, modifying, or corrupting data;

3. (c)

   conducting DoS or DDoS attacks;

4. (d)

   exploiting a vulnerability beyond demonstrating its existence;

5. (e)

   demanding payment or threatening disclosure in exchange for not reporting;

6. (f)

   any activity that violates applicable law beyond what is strictly necessary to demonstrate a security vulnerability and that cannot be remediated by Ollify through good-faith engagement.

4.3 If You Are Uncertain. If you are unsure whether a specific testing action would fall within safe harbor protections, email security@ollify.app and ask before proceeding. We would rather clarify in advance than have a researcher inadvertently step outside the policy.

5. Coordinated Disclosure and Timing

We follow a coordinated disclosure model. This means we ask researchers to report privately and give us a reasonable opportunity to fix the issue before any public disclosure.

5.1 If Remediation Takes Longer Than 90 Days. Some vulnerabilities — particularly complex architectural issues — take longer than 90 days to fully remediate. If we cannot fix a vulnerability within 90 days, we will:

1. (a)

   proactively reach out to the researcher to explain the delay and provide a revised timeline;

2. (b)

   share information about any interim mitigations we have put in place; and

3. (c)

   request a reasonable extension of the disclosure window.

We will not request extensions indefinitely. If the researcher and Ollify cannot agree on an extension, the researcher may proceed with public disclosure at day 90 in accordance with this policy.

5.2 Emergency Disclosure. If a vulnerability is being actively exploited in the wild before Ollify has had a reasonable opportunity to remediate, the researcher and Ollify may agree to a shorter disclosure timeline in the interest of public safety. Contact security@ollify.app to initiate emergency coordination.

5.3 Coordinating Publication. When you are ready to publish details of a resolved vulnerability, please let us know in advance so we can review for any remaining sensitive information and coordinate timing. We support and encourage publication — security research benefits the community and we want to help researchers get full credit for their work.

6. What We Do Not Offer

To set accurate expectations:

7. This Policy Is Not For

This VDP is specifically for reporting security vulnerabilities. Please use the correct channel for other inquiries:

8. Contact