Security and Responsible Disclosure Policy

Applies to: aita.world, app.aita.world, api.aita.world and all systems operated by AITA World, S.L.
Canonical URL: https://aita.world/security
Machine-readable version (RFC 9116): https://aita.world/.well-known/security.txt
Contact: security@aita.world

This Security and Responsible Disclosure Policy (the "Policy") is an integral part of the Public Offer — Master Terms of Access to the Aita Platform (the "Offer") and is incorporated into it by reference. This Policy is hosted on the public aita.world domain because the industry discovery standard (RFC 9116) expects it there, and because its audience — security researchers — are not Platform Participants at the moment they identify an issue. Capitalised terms used in this Policy have the meanings given in the Offer. In case of conflict, the Offer prevails.

1. Aita's Commitment

AITA World, S.L. ("Aita") takes the security of its Platform and the data entrusted to it seriously. We are grateful to security researchers, customers, partners and members of the public who identify potential vulnerabilities in our systems.

We commit to:

• promptly acknowledge receipt of a report;
• investigate all credible reports in good faith;
• keep the reporter informed of progress;
• not initiate legal action against researchers acting in good faith under this Policy.

2. Scope

This Policy covers vulnerabilities in systems for which Aita is the direct operator.

In scope

• app.aita.world and its subdomains (the Platform);
• aita.world (public website);
• api.aita.world (public Platform API);
• Aita's mobile application.

Out of scope

• Third-party services and infrastructure used by Aita — see the current list of subprocessors and vendors at aita.world/legal/subprocessors; please report vulnerabilities in those systems directly to the relevant provider;
• Social engineering attacks against Aita personnel;
• Physical security;
• Denial-of-service (DoS) or volumetric attacks;
• Issues that require the user to install a malicious browser extension, or physical access to a device;
• Vulnerabilities in outdated browsers or operating systems not supported by the Platform;
• Issues already known to Aita (we will let you know if this is the case).

3. What We Ask of Researchers

To act under this Policy, a researcher must:

3.1. Avoid harm. Do not access, alter, delete or exfiltrate data beyond the minimum required to demonstrate the vulnerability. Stop as soon as the issue is confirmed.

3.2. Do not disrupt. No denial-of-service, no stress testing, no action that degrades Platform availability for other users.

3.3. Use test accounts only. If an account is needed for testing, use one you lawfully own. Do not access other users' accounts or test against them.

3.4. Keep it confidential. Do not disclose the vulnerability publicly (including on social media, blogs, or security forums) until Aita has confirmed remediation or given explicit consent to disclosure.

3.5. Report promptly. Send a report to security@aita.world as soon as the issue is identified.

3.6. Act in good faith. Test only systems you are authorised to test. Platform Participants are not authorised to conduct security testing under §2.2(e) of the Acceptable Use Policy or §3.5(d) of the Public Offer without prior written consent — this Responsible Disclosure Policy covers researchers who find issues incidentally, not those conducting targeted scanning.

4. How to Report

Send an email to security@aita.world with:

• Subject: [Security] Short description of the issue
• Description of the vulnerability and its potential impact;
• Affected URL, endpoint or component;
• Step-by-step reproduction instructions;
• Any proof-of-concept material — screenshots, HTTP request/response logs — please attach as files rather than pasting sensitive data into the email body;
• Your contact details (name and email) if you would like updates on progress.

5. Our Process

If a timeframe cannot be met, we will let you know with an explanation.

6. Severity Classification

We classify vulnerabilities using the CVSS v3.1 base score as a reference:

7. Safe Harbour

Aita will not initiate or support legal action against researchers who:

• act in good faith and within this Policy;
• do not access data beyond what is necessary to demonstrate the issue;
• do not publicly disclose the vulnerability before Aita has fixed it or given consent to disclosure.

If a third party initiates legal action against a researcher who acted in good faith under this Policy, Aita will take reasonable steps to make clear that the researcher acted within an authorised disclosure process.

This safe-harbour commitment does not waive Aita's rights regarding conduct outside this Policy.

8. Aita's Own Security Practices

We operate the following security controls on the Platform and infrastructure:

• Encryption in transit (TLS 1.2+) and at rest (AES-256);
• Role-based access control with a default least-privilege model;
• Multi-factor authentication for Platform users and all internal Aita systems;
• Audit logging of access to sensitive resources;
• Web Application Firewall (WAF) and DDoS protection through our CDN / edge security provider (see subprocessors list);
• Automated dependency scanning and patch management;
• Documented incident response procedure;
• Notification of personal data breaches to the AEPD within 72 (seventy-two) hours as required by GDPR.

9. Contacts