Vulnerability Disclosure Policy

AI STM Learning SRL, operating as stm.ai, welcomes reports of security vulnerabilities affecting CLARA. This policy explains what research we authorise, how to contact us, and how we coordinate fixes and public disclosure with researchers.

Report a vulnerability

Email c@stm.ai with the subject CLARA security report. Reports may be written in English or Romanian. You may use a pseudonym; a reply address helps us coordinate with you.

For sensitive evidence, send a short description first and ask us to arrange a suitable transfer method. Do not include live credentials, personal data, or customer records in your initial email.

Security leadership

Cosmin Stamate, CEO of AI STM Learning SRL, leads CLARA’s internal product-security function and coordinates vulnerability assessment, remediation, and disclosure. Security reports and coordination enquiries can be sent to c@stm.ai.

Scope and testing permission

We accept reports about CLARA software developed or maintained by AI STM Learning SRL, including CLARA Core, the Security Audit, Network Monitoring and Browser Protection agents, and CLARA dashboard, API and integration components where available.

Research under this policy is limited to:

• CLARA software running in a local environment that you own or are expressly authorised to test.
• First-party content and applications at clara.stm.ai operated by AI STM Learning SRL, using only your own accounts and test data and following the safeguards below.

Customer installations, customer networks and other tenants require permission from their respective owners. This policy does not authorise testing third-party infrastructure, model providers, linked websites, or other stm.ai products and domains. If you are unsure who operates a component or whether testing is permitted, contact us before testing it.

You may still report a suspected issue in a CLARA dependency or integration. We will assess its effect on CLARA and coordinate with the relevant maintainer when appropriate.

Research safeguards

Use the least intrusive method needed to demonstrate the issue. Please:

• Keep testing low volume and avoid interrupting services or degrading other users’ experience.
• Use accounts and data you control. Do not retrieve, alter, delete or disclose another person’s data.
• Stop testing immediately if you encounter sensitive information or unexpected access to another user’s environment. Report what happened without copying more information.
• Do not use social engineering, phishing, credential guessing, denial-of-service attacks, malware, persistence or lateral movement.
• Do not exploit an issue beyond the minimum evidence needed to establish its security impact.
• Keep non-public findings and any accidentally encountered data confidential while we coordinate a disclosure plan.

If a test needs broader access, additional traffic or a potentially disruptive technique, obtain written permission for that specific test first.

Information to include

A useful report identifies:

• The affected CLARA component, version or build, and relevant URL or deployment type.
• The issue, its security impact, and any prerequisites or account privileges needed to reproduce it.
• Reproduction steps and a minimal proof of concept, with secrets and personal information removed.
• When you found the issue and whether it appears to be publicly known or actively exploited.
• Any existing CVE identifier or request made to another coordinator.
• Your preferred contact method and whether you would like public credit.

Suggested fixes, a weakness classification or a severity assessment are welcome but optional. Scanner or AI-generated findings should include enough validated evidence for us to assess the claimed impact. For AI behaviour, explain the security boundary affected, such as unauthorised tool execution, access to protected information or bypass of an access control.

Response and remediation

We aim to meet the following targets. Business days are Romanian business days.

We prioritise issues based on impact, exploitability and exposure. We will discuss the expected remediation and disclosure dates with you. These are communication targets, not a guarantee that every issue will be fixed within a particular period.

If you have not received an acknowledgement within the target, resend your email with Follow-up: CLARA security report in the subject. If coordination remains unresolved, you may seek help from an appropriate vulnerability coordinator or CSIRT.

Coordinated disclosure

Our default coordination window is 90 calendar days from receipt of a report. We will work with you to agree when to publish and what information users need to protect themselves. A fix, mitigation, active exploitation or an already public issue may justify earlier publication. We will discuss any proposed extension with you and avoid an indefinite delay.

Please give us a chance to investigate before publishing exploit details. This coordination request does not require a non-disclosure agreement, transfer of intellectual property or waiver of rights as a condition of reporting an issue or requesting CVE coordination.

Public advisories will appear on our security advisories page. Where relevant, they will explain affected versions, security impact, fixes or mitigations, and the associated CVE identifier.

Good faith research

We consider research that follows this policy authorised to the extent that AI STM Learning SRL can grant permission for the affected software and systems. We will not initiate legal action or request a law-enforcement investigation solely because of good faith research conducted within these boundaries.

This commitment applies to our company and the systems we control. We cannot grant permission on behalf of customers, suppliers or other third parties, or bind their decisions. If you encounter an unexpected boundary, stop and contact us so we can clarify permission.

CVE coordination

AI STM Learning SRL has applied to become a vendor CVE Numbering Authority. Approval is pending; we are not currently authorised to assign CVE identifiers. Reports and CVE coordination enquiries use the same contact, c@stm.ai. Where appropriate, we will coordinate with an authorised CNA.

If appointed, we will assess eligible vulnerabilities within our approved scope under the CVE Program rules, check for existing assignments and publish the corresponding records and public references. We will coordinate upstream issues with the responsible maintainer or CNA. Please tell us about earlier requests to avoid duplicate assignments.

If you disagree with an assessment or record, contact us with supporting evidence. We will explain our reasoning and seek the relevant CVE Program coordinator’s assistance where necessary.

Confidentiality and recognition

We use report information to investigate, remediate and coordinate the issue. Access is limited to people involved in that work. We may share necessary technical details with affected maintainers or vulnerability coordinators, and will minimise personal information in those exchanges.

We will ask before publishing your name or pseudonym and will not publish your private contact details. Please tell us if you prefer to remain uncredited. This policy does not offer financial rewards.

Questions about this policy or the handling of a report can be sent to c@stm.ai.