# UND Assay — Vulnerability Disclosure Policy
version: 1.0
effective: 2026-10-30
operator: Universal Network Development LLC, a Florida limited liability company ("UND", "we")

## Reporting a vulnerability in our systems
Email security@undassay.com. Include steps to reproduce. We acknowledge within 2 business days.
- **Please:** test only against your own account, do not access other people's data, and do not degrade the service.
- **Our commitment:** we will not pursue good-faith research that follows these rules.

## How we disclose problems we find in other people's tools
1. We notify the publisher and the registry it is listed in before publishing details.
2. **Active malware:** we may publish a warning within 24 hours, without exploit details.
3. **Other vulnerabilities:** we wait for a fix, or up to 90 days, before publishing details.
4. Published findings say what was found, in which version, and the evidence. Not more than is needed to protect users.