Coordinated Vulnerability Disclosure Policy

As part of Mindgard’s ongoing research, we may identify security vulnerabilities in third-party products or software.
‍
When a vulnerability is discovered, Mindgard seeks to notify and collaborate with the organization best positioned to address it (the “Responsible Organization”), enabling timely remediation. Aligned with coordinated disclosure best practices, we prioritize giving the Responsible Organization the opportunity to improve the security of its products and protect its users. At the same time, Mindgard recognizes that public disclosure is vital to a healthy cybersecurity ecosystem. We therefore advocate for timely and transparent disclosure of vulnerabilities, balancing the need for coordination with the benefits of open information sharing. Through this approach, we aim to strengthen the security and resilience of critical technology infrastructure.
‍
In all cases, our approach follows good‑faith, non‑destructive security research practices: we aim to avoid service interruptions, protect user privacy, minimize data collection, and promptly share actionable information with affected organizations to reduce real-world risk.
‍
Scope
‍This policy governs how Mindgard reports vulnerabilities discovered in third-party systems, products, or services. Customer engagements covered by contract follow customer‑specific terms and are out of scope.
‍
Responsible Disclosure 
‍In keeping with standard industry practices around coordinated vulnerability disclosure, Mindgard makes every effort to aid Responsible Organizations in discovering and remediating vulnerabilities. To ensure users are informed and able to protect themselves, Mindgard enforces a 90-day disclosure deadline after initial attempts at private disclosure, barring extensions and extenuating circumstances (as outlined below, which may warrant different disclosure guidelines). Vulnerability disclosures will be made publicly available via Mindgard’s blog and social media. Depending on the details of findings, there may also be media engagement.
‍
Please note, technical vulnerabilities often involve undefined behavior and unexpected interactions. Therefore, Mindgard may modify the timeline for disclosure at our sole discretion due to unique or unpredictable elements of that specific vulnerability.
‍
Disclosure Timeline

1. Day Zero
a. Initial Report‍
Mindgard will provide a clear and detailed report to the Responsible Organization’s designated security contact or Vulnerability Disclosure Program (VDP) channel (e.g., security@ email, VDP portal, bug bounty platform, or other public contact). The report will include a description of the vulnerability’s impact, affected components or versions, reproducible steps, a minimal proof of concept (PoC), and recommended mitigations to address the issue.
‍

‍2. Acknowledgment and Response Timeline
a. Vendor Response Expectations
Mindgard requests acknowledgment of reported vulnerabilities within 7 days. If no response is received after reasonable efforts, defined as at least three attempts via multiple contact methods over a period of 30 days or more, a third‑party coordinator (e.g., CERT/CC) may be engaged to facilitate communication.

b. Non-responsive Responsible Organizations
If the affected Responsible Organization has not acknowledged our initial disclosure by this time, Mindgard will presume they are a "Non-Responsive Responsible Organization." In this case, Mindgard will proceed toward public disclosure.
‍

‍3. Vulnerability Disclosures
a. Public Disclosure
i. 30 days after our initial report and private disclosure to the Responsible Organization, Mindgard will publicly disclose vulnerability information, including (but not limited to); summary, opinions on risk, impact, affected scope, reproduction guidance, mitigation strategies, and enough technical detail to demonstrate the issue (collectively, "vulnerability details"). If appropriate, we may request a CVE ID and include severity (e.g., CVSS) and acknowledgments. At this time Mindgard does not act as a CVE Numbering Authority and cannot assign CVE numbers ourselves.
ii. These disclosures will be made publicly available via Mindgard’s blog and social media.
‍
b. Extensions and Extenuating Circumstances (Case-by-Case)
i. Mindgard may grant a time‑boxed extension if the Responsible Organization demonstrates meaningful remediation progress, such as a ready-to-test patch or a coordinated rollout plan. Extensions are granted on a case-by-case basis and are generally up to 30 days and may be renewed if continued progress is shown. This approach balances the need to protect users, ensure patch availability, and mitigate the risk of exploitability.

ii. In certain circumstances, an embargo or coordinated release schedule may be applied for specific Responsible Organizations. Such arrangements are determined case by case and at the discretion of the executive team.

c. Sign-Off Authority
All disclosures must be approved by the relevant executive team, typically the Head of Research, before release.

d. Legal Review
Mindgard does not have a standing legal review process for disclosures. Legal counsel may be consulted on a case-by-case basis if deemed necessary by the executive team, but routine disclosures proceed without prior legal sign-off.
‍

4. AI-Specific Remediation Considerations  
a. Mindgard recognizes that vulnerabilities in Artificial Intelligence (AI), Machine Learning (ML) systems, and Large Language Models (LLMsfrequently require remediation strategies that differ from traditional software patching.

i. Definition of Remediation: We acknowledge that a "fix" for an AI vulnerability may not always involve a change to the underlying model weights or source code. Remediation may include the implementation of robust input/output filters, hardened system prompts (metaprompts), architectural changes to data retrieval (RAG), or the deployment of specialized AI guardrails.

ii. Evaluation of Effectiveness: In our collaboration with the Responsible Organization, Mindgard will evaluate these mitigations based on their robustness rather than their method. A mitigation that is easily bypassed via simple prompt variation may not be considered a complete remediation for the purpose of closing a disclosure case.

iii. Retraining Timelines: We recognize that some AI vulnerabilities can only be fundamentally addressed through model fine-tuning or retraining, which can be computationally intensive and time-consuming. Mindgard will take these technical constraints into account when considering extension requests, provided the Responsible Organization implements interim defensive measures (e.g. filters) to protect users during the retraining period.
‍

‍5. Exploited in the Wild
a. Emergency Accelerations
i. If there is evidence of credible active exploitation, severe safety risk, or widespread abuse, we may accelerate notification or issue limited defensive guidance prior to Day 30, while continuing to coordinate with the vendor.

‍
6. Feedback 
a. If you have any questions about this policy, or coordinated vulnerability disclosure in general, please feel free to reach out to security@mindgard.ai
‍