Vulnerability Disclosure Policy

Effective Date: September 26, 2026

1. Introduction and Purpose

At CreatoRain (operated by Midwest AI Solution Inc.), the security of our restaurant influencer marketing platform and the protection of our users' data are top priorities. We recognize the valuable role that independent security researchers play in keeping our platform safe. This Vulnerability Disclosure Policy outlines how security researchers can responsibly report vulnerabilities to us and what to expect in return.

We are committed to working with the security research community to identify and resolve potential security issues in a timely and transparent manner. We encourage responsible disclosure and will not take legal action against researchers who follow this policy in good faith.

2. Scope

In Scope

The following assets and services are within scope for vulnerability research:

  • *.creatorain.com — all subdomains of our primary domain
  • CreatoRain web application (app.creatorain.com)
  • CreatoRain mobile applications (iOS and Android)
  • Authentication and authorization mechanisms
  • Payment and billing infrastructure
  • Campaign management and influencer matching features
  • Restaurant and influencer data handling processes

Out of Scope

The following activities and targets are explicitly out of scope:

  • Social engineering attacks (including phishing) targeting CreatoRain employees, contractors, or users
  • Denial of Service (DoS) or Distributed Denial of Service (DDoS) attacks
  • Physical attacks against CreatoRain offices or data centers
  • Third-party services and applications that integrate with CreatoRain (e.g., Stripe payment pages, social media platforms)
  • Vulnerabilities in third-party software or dependencies unless they directly affect CreatoRain systems
  • Automated scanning or brute-force attacks that generate excessive traffic
  • Attacks against CreatoRain users or their accounts without explicit written permission
  • Spam or social engineering via CreatoRain communication channels

3. How to Report a Vulnerability

If you believe you have discovered a security vulnerability in any CreatoRain asset, please report it to us as soon as possible. Send your report via email to security@creatorain.com. We strongly encourage you to encrypt your report using our PGP key, which is available upon request.

Please do not report vulnerabilities through public channels such as social media, public forums, or issue trackers. Public disclosure before we have had an opportunity to investigate and remediate the issue puts our users at risk.

4. What to Include in Your Report

To help us triage and address your report efficiently, please include the following information:

  • A clear and concise description of the vulnerability
  • The affected asset (URL, API endpoint, mobile app version, etc.)
  • Step-by-step instructions to reproduce the vulnerability
  • Proof-of-concept code, screenshots, or video recordings, if applicable
  • The potential impact of the vulnerability (e.g., data exposure, privilege escalation, unauthorized access)
  • Your assessment of the severity (Critical, High, Medium, or Low)
  • Any suggested remediation steps
  • Your name or alias and contact information (for follow-up communication)

5. Safe Harbor

CreatoRain considers security research conducted in accordance with this policy to be authorized, and we will not initiate legal action against researchers who comply with the following principles:

  • You make a good-faith effort to avoid privacy violations, destruction of data, and disruption of our services
  • You only interact with accounts you own or with explicit permission from the account holder
  • You do not exploit a vulnerability beyond what is necessary to demonstrate its existence
  • You do not access, modify, or delete data belonging to other users
  • You report the vulnerability promptly and do not disclose it publicly before we have had an opportunity to remediate it
  • You comply with all applicable laws and regulations

If legal action is initiated by a third party against you for activities conducted in compliance with this policy, CreatoRain will take reasonable steps to make it known that your actions were conducted in accordance with our Vulnerability Disclosure Policy.

6. Response Timeline

We are committed to responding to vulnerability reports in a timely manner. Our target response timeline is as follows:

  • Acknowledgment: Within 48 hours of receiving your report, we will confirm receipt and assign a tracking identifier
  • Triage: Within 5 business days, our security team will assess the report, validate the vulnerability, and determine its severity
  • Status Update: We will provide regular updates on the progress of our investigation and remediation efforts, typically every 7-10 business days
  • Remediation: We aim to resolve critical and high-severity vulnerabilities within 30 days, and medium and low-severity issues within 90 days
  • Notification: Once the vulnerability has been remediated, we will notify you and provide details of the fix

7. Rewards and Recognition

We value the contributions of security researchers who help keep CreatoRain and our users safe. We offer the following recognition and rewards:

Hall of Fame

With your permission, we will acknowledge your contribution on our Security Researcher Hall of Fame page. You may choose to be credited by name, alias, or remain anonymous.

Bounty Program

For critical and high-severity vulnerabilities that are novel and have a demonstrable impact on user security, CreatoRain may offer a monetary bounty at our discretion. Bounty amounts are determined based on the severity, impact, and quality of the report. We reserve the right to determine whether a report qualifies for a bounty.

Eligibility

To be eligible for rewards or recognition, you must:

  • Be the first person to report the vulnerability
  • Report a vulnerability that was previously unknown to CreatoRain
  • Comply with all terms of this Vulnerability Disclosure Policy
  • Not be a current or former employee or contractor of CreatoRain or Midwest AI Solution Inc.
  • Not reside in a country subject to international trade sanctions

8. Disclosure Policy

CreatoRain follows a coordinated disclosure process. We request that researchers refrain from publicly disclosing vulnerability details until we have had an opportunity to investigate and remediate the issue.

  • We request a 90-day disclosure window from the date we confirm receipt of your report
  • If we are unable to remediate the issue within 90 days, we will work with you to agree on an extended timeline or a partial disclosure
  • We will coordinate with you on the timing and content of any public disclosure
  • We may publish a security advisory when a vulnerability has been remediated, and we will credit the researcher (with their permission) in the advisory

9. Legal Considerations

This policy is intended to be compatible with existing laws and regulations. Nothing in this policy should be interpreted as authorization to engage in activities that violate applicable law. CreatoRain reserves the right to modify this policy at any time. Researchers are encouraged to review this policy regularly to stay informed of any changes.

If you are unsure whether your planned research activities comply with this policy, please contact us at security@creatorain.com before proceeding. We are happy to discuss specific research plans and provide guidance.

10. Contact Information

For all vulnerability reports and questions about this policy, please contact our security team:

  • Email: security@creatorain.com
  • Subject line: Vulnerability Report — [Brief Description]
  • PGP key: Available upon request