Vulnerability Disclosure Policy

In scope:

• The website ares-cyber.ai and all of its subdomains.
• The Ares Platform as operated by us as a managed SaaS service, including its APIs.

Prompt injection and similar attacks on the platform’s AI agents are in scope when they have a security impact, such as access to another customer’s data, actions outside an authorized scan scope, or disclosure of secrets. Inaccurate model output alone is not a vulnerability.

Self-hosted and air-gapped deployments run on infrastructure our customers own and control. We cannot authorize testing of them, so they are out of scope unless the customer has given you explicit written consent. If you have that consent, or you are the customer, vulnerabilities you find in the Ares software itself are in scope: report them to us without including the customer’s data, and we will fix them for all affected customers and notify those customers directly.

Email security@ares-cyber.ai with:

• The affected system, URL or version.
• A description of the vulnerability and its impact.
• Steps to reproduce it, with a proof of concept if you have one.
• How you would like to be credited, or that you prefer to stay anonymous.

We accept reports in English and Italian. You may report anonymously, but then we cannot update or credit you.

• Test only systems in scope, and only accounts you own or have explicit permission to use.
• Point features that connect to external targets, such as scans, only at systems you own.
• Access no more data than you need to demonstrate the issue. If you encounter personal or customer data, stop, report it, and delete it once reported.
• Do not degrade our services, and keep automated testing at a low rate.
• Do not make a report conditional on payment.

Please keep the details confidential until a fix is available and we have agreed a disclosure date with you, or for 90 days after your report, whichever comes first. If a fix needs longer, we will explain why and ask for a specific extension, never for indefinite silence. Customers who host Ares apply updates on their own schedule, so we may ask you to wait briefly after a release. If a vulnerability is being actively exploited, we may publish earlier and will tell you first.

We do not offer monetary rewards. Ares Cyber is a young company and cannot run a paid bug bounty program, and we would rather tell you that plainly than leave it unclear. Your work still matters to us, and we commit to recognizing it in the ways we can:

• Hall of fame. With your consent, we list your name or handle, with a link of your choice, on this page.
• Credit in advisories and release notes. When we publish an advisory or release notes for the fix, we credit you as the finder in the form you choose, or keep you anonymous if you prefer.
• CVE identifiers. When a vulnerability qualifies for a CVE, we request one on your behalf and credit you in the record. Ares Cyber is not a CVE Numbering Authority (CNA), so we submit the request to MITRE or to the CNA whose scope covers the affected product. That CNA decides whether to assign an identifier.

When you research in good faith and in line with this policy, we consider your research:

• Authorized under applicable computer-crime laws, including Italian law, and we will not initiate or support legal action against you for accidental, good-faith violations of this policy.
• Authorized under applicable anti-circumvention laws, and we will not bring a claim against you for circumventing technical controls on systems in scope.
• Exempt from restrictions in our Terms and Conditions or other terms of use that would interfere with security research, which we waive on a limited basis.
• Lawful, helpful to the security of the internet, and conducted in good faith.

If a third party takes legal action against you for activity that complied with this policy, we will make it known that we authorized it. This safe harbor covers only claims under our control and does not bind customers, other third parties, or public authorities. If you are unsure whether something is allowed, ask us first.

Ares Cyber S.r.l. is the controller of the personal data in your report, such as your name or handle and email address. We use it to handle your report, contact you, and credit you if you wish, based on our legitimate interest in securing our systems (Art. 6(1)(f) GDPR) and, where reporting rules apply, our legal obligations (Art. 6(1)(c) GDPR). We do not share your identity outside Ares Cyber without your consent unless the law requires it, and we keep report data for as long as needed to handle the report and meet our legal obligations. See our Privacy Policy for your rights.

• Denial-of-service testing, social engineering, phishing, and physical attacks.
• Services operated by third parties, such as our hosting or email providers, unless our configuration causes the issue (for example, a subdomain takeover).
• Scanner output without a demonstrated impact, such as missing headers, TLS recommendations, or version disclosure.
• Clickjacking or CSRF without a sensitive action, self-XSS, and email authentication (SPF, DKIM, DMARC) findings without demonstrated spoofing.