Eigen Security Vulnerability Disclosure Policy

Effective Date: 24th February 2026   

Security Contact: security@eigen.co 

1. Purpose 

This Security Policy supports Eigen’s security.txt DNS record and defines the process for responsible vulnerability disclosure. This policy establishes how security researchers can report vulnerabilities and how Eigen handles, investigates, and remediates reported issues. 

2. Scope 

This policy applies to all publicly accessible systems, services, applications, APIs, and infrastructure owned or operated by Eigen, unless explicitly excluded. 

3. Reporting a Vulnerability 

Security researchers who identify a potential vulnerability are encouraged to report it to: 

Email: security@eigen.co 

Reports should include: 

• Clear description of the vulnerability 
• Steps to reproduce the issue 
• Affected systems, domains, or endpoints 
• Proof-of-concept code, logs, or screenshots (if available) 
• Assessment of potential impact

4. Eigen’s Commitment 

Upon receiving a vulnerability report, Eigen commits to: 

• Acknowledge receipt within 3 business days 
• Triage and validate the reported issue 
• Provide status updates when appropriate 
• Remediate confirmed vulnerabilities in a risk-prioritized manner 
• Coordinate disclosure with the reporting researcher 
• Publicly acknowledge researchers (with permission) 

5. Responsible Disclosure Guidelines 

Researchers must: 

• Act in good faith and avoid privacy violations 
• Avoid accessing, modifying, or deleting data that does not belong to them 
• Avoid actions that degrade, disrupt, or damage services 
• Not exploit a vulnerability beyond what is necessary to demonstrate impact 
• Not publicly disclose vulnerabilities before coordinated resolution 
• Comply with all applicable laws and regulations 

6. Safe Harbor 

Eigen will not pursue civil or criminal legal action against researchers who discover and report vulnerabilities in good faith and in compliance with this policy. If legal action is initiated by a third party against a researcher acting in accordance with this policy, Eigen will make it known that the researcher complied with this policy. 

7. Bug Bounty Program 

Eigen may offer discretionary rewards for eligible vulnerability reports. Reward eligibility is determined based on severity, impact, exploitability, quality of report, and adherence to this policy. 

General guidelines: 

• Only previously unknown vulnerabilities are eligible 
• Duplicate reports may not be eligible for reward 
• Testing must comply with this policy to qualify 
• Reward amounts are determined at Eigen’s discretion 

Submission of a report does not guarantee payment. Specific bounty ranges, if applicable, may be published separately. 

8. Compliance & Security Standards 

Eigen maintains an information security program aligned with industry standards including ISO 27001:2022 security principles. Vulnerability management processes form part of Eigen’s broader risk management framework. 

9. Policy Governance & Review 

This policy is reviewed at least annually and updated as necessary to reflect changes in regulatory requirements, threat landscape, or business operations.