# Vulnerability disclosure policy

How to report a vulnerability in PageCycle, PageCheck, our website or these docs: scope, how to test, safe harbor and how fast we respond.

## How to report

> **Info:** Report a vulnerability to [security@braingrid.ai](mailto:security@braingrid.ai). We acknowledge your report within 2 business days.

Your report needs three things:

- What you found and where: the app and the screen or Rovo action, or the page on atlassian.braingrid.ai.
- The steps to reproduce it, and the impact you expect.
- How to reach you, and whether you want credit.

Please keep the details private until we have fixed the issue.

## What is in scope

### In scope

- PageCycle and PageCheck, our apps for Confluence Cloud.
- atlassian.braingrid.ai: the website and these docs.

### Out of scope

- Atlassian's own platform and products, including Confluence and Forge. Report those to Atlassian.
- Other BrainGrid products.
- Issues that need a victim's device or account to be compromised first.
- Denial of service, load testing, scanning at volume, and anything that runs up usage or cost.
- Social engineering and physical attacks.
- Output from an automated scanner without a demonstrated impact.

## How to test

- **The apps.** Test on a Confluence Cloud site you own or administer, with accounts you control. Using two of your own accounts to show that one person can reach another's data is fine.
- **The website and docs.** Browse them and send requests by hand. No automated scanning at volume.
- **Other people's data.** Never access, change or delete it. If you reach it by accident, stop, do not keep a copy, and tell us.
- **When to stop.** Once you have shown the issue. Do not go further to see what else you can reach.

## Safe harbor

We treat research that follows this policy as authorized. We will not take legal action against you for it. For that research, we waive sections 2.1(a)(v) and (vi) of our [terms](https://atlassian.braingrid.ai/terms#st-2.1) (security tests, and access to data the terms do not authorize), and we will not use the suspension right in section 2.2. We cannot speak for Atlassian or anyone else: Atlassian's own terms still apply to Confluence and Forge. If you are not sure whether something is allowed, ask us first at [security@braingrid.ai](mailto:security@braingrid.ai).

## What we promise

We rate each issue with CVSS and tell you the rating. We fix issues in the apps within the deadlines of Atlassian's security bug fix policy for cloud apps, counted from your report:

| Severity | Fixed within |
|---|---|
| Critical (9.0 and up) | 10 days |
| High (7.0 to 8.9) | 4 weeks |
| Medium (4.0 to 6.9) | 12 weeks |
| Low (below 4.0) | 25 weeks |

We tell you when the fix ships and, if you ask, credit you by the name you give us.

## Rewards

We do not pay rewards for reports. If that changes, this page will say so.

## If an issue affects your site

When an issue affects customers, we tell Atlassian within 24 hours of discovering it. Where possible, we tell affected customers within 72 hours of identifying their exposure. We say what happened, what it touched and what we did about it. A fix that needs no new permissions reaches every site as soon as it ships. A fix that needs new permissions waits until your site admin approves the update.

*Effective October 14, 2026 · BrainGrid AI, Inc.*