Plain-language summary (not a substitute for the text below). Report security bugs safely and legally under these rules: test only in the sandbox and your own data, don’t break privacy or availability, report to security@[domain], and we won’t pursue you and may pay a reward.
Language. This document is drafted in English. Translations are provided for convenience only; in case of conflict the English text prevails. Operator. Aleksei Talamanov, a private entrepreneur registered in the Republic of Armenia (state registration number 20292045, TIN 286.1582228), with the registered address at 27 N. Tigranyan str., Arabkir, Yerevan 0014, Republic of Armenia (“Operator”, “we”, “us”). Contact: legal@agentid-registry.com.
1. Safe harbour
If you make a good-faith effort to comply with these terms during security research, the Operator will consider your research authorised, will not pursue or support legal action against you for it, and will work with you. This authorisation does not extend to third parties (cloud, payment or partner systems) or to violating any law.
2. Rules of engagement
You may: test against the sandbox environment and against data of accounts you own or have explicit permission to test; probe for common web and API vulnerabilities. You must not: access, modify or delete other users’ data; degrade availability (no DoS/DDoS, no automated high-volume scanning against production); use social engineering, physical attacks, or attacks on employees or third-party providers; publicly disclose a vulnerability before the Operator has remediated it and agreed to disclosure.
3. Reporting
Report to security@agentid-registry.com with steps to reproduce, impact, and any proof-of-concept, encrypted with our PGP key where sensitive. We acknowledge within 3 business days, trioage and keep you updated, and credit you (with your consent) after the fix.
4. Scope and rewards
In scope: the Platform’s web application, public APIs and SDKs. Out of scope: best-practice suggestions without demonstrated impact, rate-limiting on non-sensitive endpoints, issues in third-party services, and social-engineering findings. Rewards range from USD 200 to USD 10,000 depending on severity (CVSS) and quality, at the Operator’s reasonable discretion; duplicates are rewarded once (first reporter). Rewards require you not to be a sanctioned person and to comply with tax rules; the Operator may withhold where legally required.
5. Legal
These terms are governed by the laws of the Republic of Armenia. They do not grant rights to test any system other than the Operator’s, and do not waive any third party’s rights.
Document BUG-08 · Version 1.0 · Effective 1 October 2026 · Previous versions are available at https://agentid-registry.com/legal/history. © AgentID Registry. CONFIDENTIAL DRAFT until published — subject to review by licensed counsel in the Republic of Armenia, the European Union and the United States.