Security & Vulnerability Reporting Policy

Security posture and scope

Security is a shared responsibility among the operator, providers, workspace administrators, and users. This page provides a reporting process for BuildBench-controlled services at buildbench.online and this Legal Center. It is not evidence of a completed security audit, certification, bug bounty, or particular technical control.

Reporting a vulnerability

Email [email protected] with the subject “Security report.” Include the affected URL or component, a clear description, likely impact, minimal reproduction steps, time observed, and a safe way to contact you. Redact secrets and personal data; do not attach other users’ records.

If a report needs to contain sensitive evidence, ask first for a secure transfer method. Do not send passwords, private keys, exploit archives containing live secrets, or unnecessary personal data through ordinary email. No encrypted intake channel is represented as available until verified.

Testing boundaries

This reporting policy does not authorize intrusive testing or access to data or systems you do not own. Use your own account and data for minimal, non-destructive observations. Obtain specific written authorization before any testing that could affect other accounts, service availability, or protected systems.

• Do not conduct denial-of-service, load testing, phishing, social engineering, malware deployment, credential attacks, or physical access attempts.
• Do not access, download, modify, or retain another person’s data, persist access, move laterally, or disrupt payment or credit systems.
• Do not test third-party infrastructure or customer sites without authorization from the responsible owner. A BuildBench-hosted URL does not itself grant permission.
• If you unexpectedly encounter sensitive data, stop, do not investigate further, and report the location and minimal safe context.

Handling and coordinated disclosure

We will review reports and seek to coordinate remediation and disclosure according to the risk and applicable law. We may request clarification or safe reproduction details. Please allow reasonable coordination before publishing details that could expose users, and avoid publishing personal data or exploit secrets.

No response time, remediation deadline, payment, reward, or legal safe harbor is promised under this policy. This policy does not expand legal testing authority. Any separately agreed authorization or disclosure arrangement should be documented in writing.

Account incidents and customer responsibilities

For suspected account takeover, revoke exposed credentials or sessions using available controls, protect your email account, and contact support. Workspace administrators should remove unnecessary access and review published changes. Test AI-generated code and configured integrations before deployment, protect secrets, and maintain independent backups.

For personal data requests, use the Privacy Policy channel. For abuse or harmful content, follow the Acceptable Use Policy.

Security questions

BuildBench administrators may access user creations and projects for security purposes, but cannot access private chats. BuildBench does not use user content for advertising or AI training. For questions about protections relevant to your project or intended data, contact support before uploading sensitive information. Any specific security commitment must be confirmed in the applicable service agreement.