Responsible Disclosure

1. How to report

Email security@plangentai.com with the subject “Security report”. Include what you found, the steps to reproduce it and the impact you expect. We acknowledge reports within 3 working days and keep you updated until the fix.

2. Scope

• In scope: the PlanGent website and app, its sign-in and file handling, and the PlanGent agent (including prompt-injection that reaches another user’s data).
• Out of scope: our providers’ own systems (report those to them), social engineering, physical attacks, and denial-of-service testing.

3. Rules for testing

• Use only your own account and data. Never access, change or delete someone else’s data; if you reach it by accident, stop and tell us.
• Do not degrade the Service for others.
• Give us reasonable time to fix the issue before you share it publicly.

4. Our promise

If you follow these rules in good faith, we will not take legal action against you for your research, and we will credit you when the fix ships if you wish.