Vulnerability Disclosure Policy

1. Introduction and Purpose

At CreatoRain (operated by Midwest AI Solution Inc.), the security of our restaurant influencer marketing platform and the protection of our users' data are top priorities. We recognize the valuable role that independent security researchers play in keeping our platform safe. This Vulnerability Disclosure Policy outlines how security researchers can responsibly report vulnerabilities to us and what to expect in return.

We are committed to working with the security research community to identify and resolve potential security issues in a timely and transparent manner. We encourage responsible disclosure and will not take legal action against researchers who follow this policy in good faith.

2. Scope

3. How to Report a Vulnerability

If you believe you have discovered a security vulnerability in any CreatoRain asset, please report it to us as soon as possible. Send your report via email to security@creatorain.com. We strongly encourage you to encrypt your report using our PGP key, which is available upon request.

Please do not report vulnerabilities through public channels such as social media, public forums, or issue trackers. Public disclosure before we have had an opportunity to investigate and remediate the issue puts our users at risk.

4. What to Include in Your Report

To help us triage and address your report efficiently, please include the following information:

• A clear and concise description of the vulnerability
• The affected asset (URL, API endpoint, mobile app version, etc.)
• Step-by-step instructions to reproduce the vulnerability
• Proof-of-concept code, screenshots, or video recordings, if applicable
• The potential impact of the vulnerability (e.g., data exposure, privilege escalation, unauthorized access)
• Your assessment of the severity (Critical, High, Medium, or Low)
• Any suggested remediation steps
• Your name or alias and contact information (for follow-up communication)

5. Safe Harbor

CreatoRain considers security research conducted in accordance with this policy to be authorized, and we will not initiate legal action against researchers who comply with the following principles:

• You make a good-faith effort to avoid privacy violations, destruction of data, and disruption of our services
• You only interact with accounts you own or with explicit permission from the account holder
• You do not exploit a vulnerability beyond what is necessary to demonstrate its existence
• You do not access, modify, or delete data belonging to other users
• You report the vulnerability promptly and do not disclose it publicly before we have had an opportunity to remediate it
• You comply with all applicable laws and regulations

If legal action is initiated by a third party against you for activities conducted in compliance with this policy, CreatoRain will take reasonable steps to make it known that your actions were conducted in accordance with our Vulnerability Disclosure Policy.

6. Response Timeline

We are committed to responding to vulnerability reports in a timely manner. Our target response timeline is as follows:

• Acknowledgment: Within 48 hours of receiving your report, we will confirm receipt and assign a tracking identifier
• Triage: Within 5 business days, our security team will assess the report, validate the vulnerability, and determine its severity
• Status Update: We will provide regular updates on the progress of our investigation and remediation efforts, typically every 7-10 business days
• Remediation: We aim to resolve critical and high-severity vulnerabilities within 30 days, and medium and low-severity issues within 90 days
• Notification: Once the vulnerability has been remediated, we will notify you and provide details of the fix

7. Rewards and Recognition

We value the contributions of security researchers who help keep CreatoRain and our users safe. We offer the following recognition and rewards:

8. Disclosure Policy

CreatoRain follows a coordinated disclosure process. We request that researchers refrain from publicly disclosing vulnerability details until we have had an opportunity to investigate and remediate the issue.

• We request a 90-day disclosure window from the date we confirm receipt of your report
• If we are unable to remediate the issue within 90 days, we will work with you to agree on an extended timeline or a partial disclosure
• We will coordinate with you on the timing and content of any public disclosure
• We may publish a security advisory when a vulnerability has been remediated, and we will credit the researcher (with their permission) in the advisory

9. Legal Considerations

This policy is intended to be compatible with existing laws and regulations. Nothing in this policy should be interpreted as authorization to engage in activities that violate applicable law. CreatoRain reserves the right to modify this policy at any time. Researchers are encouraged to review this policy regularly to stay informed of any changes.

If you are unsure whether your planned research activities comply with this policy, please contact us at security@creatorain.com before proceeding. We are happy to discuss specific research plans and provide guidance.

10. Contact Information

For all vulnerability reports and questions about this policy, please contact our security team:

• Email: security@creatorain.com
• Subject line: Vulnerability Report — [Brief Description]
• PGP key: Available upon request