Vulnerability Disclosure Policy

PulseMind Studios commits to rapid, transparent coordination for any vulnerability submitted in good faith:

PulseMind Studios considers ethical security research conducted within this policy to be authorized. If you make a good faith effort to comply with this policy:

• We will not initiate or pursue civil legal action against you for accidental, good-faith violations.
• We will not report your activity to law enforcement as unauthorized access (under the DMCA or CFAA).
• We will coordinate with you to validate and credit your findings in our security acknowledgments.

In Scope:

• Local privilege escalation vulnerabilities in StickyShell Windows binaries.
• Insecure deserialization or memory corruption in local note JSON parsing.
• Subdomain takeover or cryptographic weaknesses on *.pulsemindstudios.com.

Out of Scope: Denial of Service (DoS) against web infrastructure, automated vulnerability scanner reports with no proof-of-concept, and social engineering attacks against team members.