Security Policy

Responsible Disclosure

At Aris888, we take the security of our platform seriously. If you discover a security vulnerability, we encourage you to report it responsibly.

How to Report

• Email: security@aris888.io
• Web: Contact Form
• Security.txt: /.well-known/security.txt

What to Include

• A detailed description of the vulnerability
• Steps to reproduce the issue
• Any proof-of-concept code or screenshots
• Your contact information for follow-up

Our Commitment

• We will acknowledge your report within 72 hours
• We will keep you informed about our progress
• We will credit you in our Hall of Fame (if you wish)
• We will not take legal action against researchers acting in good faith

Scope

This policy applies to all Aris888 services hosted on:

• aris888.io and all subdomains
• The Aris888 desktop and VR applications
• Official Aris888 APIs and WebSocket endpoints

Out of Scope

• Social engineering attacks
• Physical security testing
• Denial of Service (DoS) attacks
• Third-party services not operated by Aris888

Legal Framework

For detailed legal terms regarding data protection, privacy, and information security, please refer to our Corporate Privacy, Information Security & PDPL Undertaking.

Acknowledgments

We maintain a Security Hall of Fame to recognize researchers who have responsibly disclosed vulnerabilities. We appreciate the security community's efforts in helping us keep Aris888 safe.