PROVISIONAL TEXT

• This text was written by the engineering team to describe what the site does at this revision. It has not been reviewed by counsel — that review is an open decision (D-105) — and it is not legal advice.
• A fact the owner still has to supply is marked [owner to confirm]. Where you see it, nobody has decided yet, and nothing has been invented to fill the gap.
• This document is available in English only until its translation has been reviewed.
• Revision 2026-09-24.1, issued 24 September 2026.

HOW TO REPORT

• Write to support@siasol.ai and begin the subject with the word Security, so it is recognisable as a report. That address is the only reporting channel at this revision.
• Please include: the address or feature affected; the steps to reproduce what you found, as precisely as you can; what you believe the impact is; and how to reach you for questions.
• Do not put working attack code, credentials or other people’s data in the message. A description is enough to start.

WHAT TO EXPECT

• Reports are read by the people who run the platform.
• The time within which a report is acknowledged, and within which a first assessment is given: [owner to confirm].
• No reward programme is offered at this revision, and this page does not promise one.
• A report arrives as ordinary email and is held as long as it takes to deal with it, under the retention stated at /legal/privacy.

WHILE YOU LOOK

• Do not access, change or delete data that is not yours, and stop and report if you find you can.
• Do not degrade the service for other visitors.
• Do not test against another visitor’s demonstration session; the rules at /legal/acceptable-use apply.
• Do not disclose what you found publicly before it has been fixed, or before you have heard back — whichever comes first within a reasonable time.
• A safe-harbour statement for research conducted in good faith under these rules: [owner to confirm].

ENCRYPTED REPORTS AND SECURITY.TXT

• No encryption key is published at this revision, and no security.txt is served under /.well-known/. When one is, this page will say so.
• What is worth knowing about this site’s attack surface: it is a set of static files. There is no form, no database behind the pages, no session and no server-side rendering. That removes whole classes of weakness and it does not remove all of them.