Welcome to Rezo’s AI Armor

A Vulnerability Disclosure Program (VDP) is a process that allows individuals to report security flaws or weaknesses they discover in a company’s systems. It provides guidelines for reporting these vulnerabilities, enabling the company to address them quickly and maintain system security. This program helps protect both the company and its customers by preventing potential cyberattacks.

Implementing a VDP helps Rezo.ai to efficiently reduce risk by quickly identifying and fixing security vulnerabilities to minimize potential threats; to enhance security capabilities by improving and expanding the organization’s ability to manage and respond to security issues; and to protect the brand by maintaining and strengthening trust and reputation through systems that are secure and reliable.

Developers, researchers, security professionals and others interested in enhancing cybersecurity can report vulnerabilities.

To report a vulnerability, please write to us at vdp@rezo.ai with a comprehensive description, steps to reproduce, impact assessment, and any pertinent screenshots or documentation. Your contribution is invaluable in enhancing our security.

When you report a vulnerability in the critical sector, you become part of Rezo.ai’s extended family. We will acknowledge your contribution appropriately. If you prefer to remain anonymous, we will respect your privacy. Participate in our VDP and help us work together to make India cybersafe.

At Rezo.ai, we are committed to maintaining the highest level of confidentiality. You must not publicly disclose any information about security vulnerabilities without written consent from Rezo.ai.

Submission and Response Time

Due to the high volume of submissions, processing your report may take some time. We are committed to acknowledging and responding to all emails and reports within 7–10 working days. We take these reports seriously and appreciate your efforts in helping us maintain the security of our systems.

Report Evaluation

The originality, quality and content of your report will be evaluated during the processing of the submission. Please ensure that your report clearly explains the impact and exploitability of the issue, along with a detailed proof of concept.

Supporting Materials

Ensure that any supporting materials, such as proof of concept videos and images, and data belonging to Rezo and its customers are not uploaded to any third-party website(s).

Additional Information

You must provide additional information if requested. Failure to do so may result in the invalidation of your submission.

Respect for Existing Applications

Show respect for Rezo.ai’s existing applications and refrain from running any test cases that may disrupt our services.

Security and Privacy

To protect Rezo.ai’s sensitive data and the privacy of other users, researchers should demonstrate impact in a secure manner. Cease testing and notify us immediately if you discover any exposure of non-public or Personally Identifiable Information (PII) data. Researchers must purge any stored non-public or PII data of the organization upon reporting a vulnerability. If you are unable to determine the impact without possibly accessing sensitive or production data, please let us know so we can investigate the matter on your behalf.

Automated Tools

Do not use any automated tools or scripts to brute force or flood our applications, as they can be disruptive or cause systems to misbehave. Doing so will render your submission invalid and result in complete disqualification from similar programs by Rezo.ai.

Non-Disclosure

Even after a vulnerability has been fixed, do not publicly disclose any information or data related to the discovered or reported vulnerabilities.

While we don’t offer monetary rewards, we do have a special subroutine for our cyber guardians. The Hall of Fame awaits those who help enhance our AI defenses. Your digital signature could be immortalized in Rezo’s machine learning models, based on the impact of your discovery.

Our AI Armor is focused on securing the following key areas: the Central Data Hub at my.rezo.ai, and the Autonomous Conversation Matrix at az-converse.rezo.ai. These are the primary nodes where your expertise can help us strengthen our AI defenses.

All other assets, domains and subdomains not listed as in-scope targets are out of scope. We apologize for any inconvenience and appreciate your understanding.

We encourage researchers to focus on the following areas:

• Exfiltration of Sensitive or Personal Data. Use only your own accounts for testing data exfiltration; do not test on actual customer data.
• Business Logic Flaws. Identify weaknesses in the system’s business processes.
• Remote Code Execution. Check for vulnerabilities that allow unauthorized code execution.
• SQL and Command Injection. Test for vulnerabilities where malicious code can be injected into the system.
• Authentication Bypass. Discover methods to bypass authentication mechanisms.
• Cross Site Scripting (XSS). Look for opportunities to inject malicious scripts.
• Cross Site Request Forgery (CSRF). Test for unauthorized actions that can be performed on behalf of a user.
• Insecure Direct Object References. Check for vulnerabilities that expose internal objects.
• Privilege Escalation. Identify ways to gain unauthorized access to higher privileges.

Some reports are considered low-priority in our AI architecture and are excluded from recognition. These include:

• Clickjacking on non-sensitive action interfaces
• CSRF on unauthenticated data streams
• Known vulnerable libraries without a proof of concept
• CSV injection without demonstrated risk
• SSL/TLS best practices
• DoS / DDoS activities
• Content spoofing without HTML/CSS modification
• Rate limiting on non-authenticated endpoints
• CSP best practices
• Cookie flag issues
• Email configuration best practices
• Version disclosure
• Tabnabbing
• Open redirects without security impact
• Social engineering vulnerabilities
• Subdomain takeover
• Physical testing
• Mail server domain misconfiguration, including email spoofing and missing DMARC, SPF or DKIM records
• Internal IP address disclosure
• Presence of application or web browser ‘autocomplete’ or ‘save password’ functionality
• Self-XSS