Introduction
Pantheos Forge Inc. ("Pantheos Forge") takes the security of our systems and our customers seriously. We welcome reports from independent security researchers, customers, and members of the public who have identified potential security vulnerabilities in our systems. This Vulnerability Disclosure Policy ("Policy") describes how to report a vulnerability to Pantheos Forge, what you can expect from us in return, and the legal safe-harbor commitments we make to good-faith researchers.
Scope
*.pantheosforge.com(production websites and web applications)- Apophis platform (production endpoints owned by Pantheos Forge)
- Pantheos Forge mobile applications, if and when published
- Pantheos Forge official APIs
- Third-party services not operated by Pantheos Forge (report to the relevant third party)
- Customer environments tested using Apophis (report directly to those customers)
- Social engineering attacks against personnel, contractors, or customers
- Physical attacks against Pantheos Forge property
- Denial-of-service attacks or volumetric / load testing
- Spam, automated form submissions, or other non-vulnerability nuisance reports
- Findings from automated scanners without manual verification and a clear impact statement
- Vulnerabilities requiring physical access to a victim's device
- Reports of outdated software versions without a demonstrated exploit
- Missing security headers, SPF / DMARC issues, or other low-impact configuration issues without a demonstrated attack scenario
How to Report
Submit your report to security@pantheosforge.com. You may encrypt sensitive content using our PGP key at https://www.pantheosforge.com/.well-known/security-pgp.asc.
Please include as much of the following as possible:
- A clear description of the vulnerability
- The asset, URL, or endpoint affected
- Steps to reproduce, including any required accounts, payloads, or tooling
- A proof-of-concept (screenshots, request/response captures, or short scripts)
- Your assessment of impact and severity
- Whether you intend to publish your findings, and your proposed timeline
- How you would like to be credited (or whether you prefer to remain anonymous)
What You Can Expect From Us
We commit to the following response targets for reports submitted under this Policy:
With your permission, we will provide public credit on our security acknowledgments page once the issue is resolved.
Rules of Engagement
To act in good faith under this Policy, you agree to:
- Test only against assets in the Scope section above;
- Avoid privacy violations, degradation of user experience, disruption to production systems, and destruction or modification of data;
- Use only your own accounts or accounts you have explicit written permission to test;
- Stop testing and report immediately if you encounter customer data, credentials, personal information, or any sensitive non-public information;
- Do not exfiltrate, copy, retain, share, or publish any data accessed during testing beyond the minimum necessary to demonstrate the vulnerability;
- Give us a reasonable opportunity to investigate and remediate before any public disclosure (we ask for at least 90 days, but will work with you on a coordinated timeline);
- Do not engage in extortion, threats, or demands for payment in exchange for disclosure;
- Comply with all applicable laws.
Safe Harbor
Pantheos Forge considers good-faith security research conducted under this Policy to be:
- Authorized under the U.S. Computer Fraud and Abuse Act (18 U.S.C. § 1030) and similar state laws (including the Texas Penal Code, Chapter 33). We will not bring or support a civil or criminal action against you for activity that complies with this Policy;
- Exempt from the anti-circumvention provisions of the Digital Millennium Copyright Act (DMCA). We will not bring a DMCA claim against you for circumvention of technological controls in connection with research that complies with this Policy;
- Exempt from restrictions in our Website Terms of Use that would otherwise prohibit security research, to the extent necessary to comply with this Policy.
This safe harbor applies only to claims under our control. We cannot waive third-party rights. If a third party initiates legal action against you for activity conducted in good faith under this Policy, we will make reasonable efforts to make clear that your activity was authorized.
If at any time you are unsure whether your planned activity is consistent with this Policy, please contact us at security@pantheosforge.com before proceeding.
Bounty / Rewards
At this time, Pantheos Forge does not operate a paid bug bounty program. We may offer recognition, swag, or discretionary rewards at our sole discretion. We expect to formalize a paid program in the future and will update this Policy when we do.
Acknowledgments
With permission, researchers who report valid, in-scope vulnerabilities will be listed on our acknowledgments page at https://www.pantheosforge.com/security/acknowledgments.
Contact
Security security@pantheosforge.com
PGP Key /.well-known/security-pgp.asc
security.txt /.well-known/security.txt