Responsible disclosure

GLS Solutions LLC is committed to ensuring the safety and security of our customers and employees. We strive to create an environment of trust and open collaboration with the security community, and we recognize the importance of vulnerability disclosures and whistleblowers in maintaining safety and security for everyone - our customers, employees, and the company. This policy reflects our core values and fulfills our legal obligation to good-faith security researchers and whistleblowers who provide their expertise and help add an extra layer of security to our systems and processes.

If you believe you’ve discovered a potential vulnerability in our systems, please read the Vulnerability Disclosure Policy below. By submitting vulnerability reports, you agree that you’ve read, understood, and will follow our Vulnerability Disclosure Policy.

Vulnerability Disclosure Policy

Legal Posture

GLS Solutions LLC will not initiate legal action against individuals who submit vulnerability reports through our official channels, provided they follow our guidelines. We agree not to pursue legal action against individuals who:

Do not cause harm. Even during system testing or research, no individuals are permitted to engage in activities that disrupt, damage, or otherwise cause harm to or defraud GLS Solutions, our customers, our employees, or our brand — including denial of service attacks, social engineering, phishing, spam, social media scams, fraudulent transactions, or physical attacks.

Test responsibly. Individuals may only interact with and test bugs against accounts they own, and conduct testing solely on in-scope systems, respecting systems, devices, and activities that are out of scope.

Respect confidentiality. The details of any discovered vulnerabilities must remain confidential until they are authorized for release by the GLS Solutions Security team. If individuals uncover sensitive information such as personal data or user credentials as part of their findings, they must stop immediately and report it to us. It is not acceptable to save, store, copy, or otherwise retain sensitive information in any context.

Act compliantly. All individuals must adhere to the laws of their location and the location of GLS Solutions LLC. For activities that violate laws that would only result in a claim by GLS Solutions LLC (and not a criminal claim), GLS Solutions LLC should be consulted in advance, and they may be permitted if GLS Solutions LLC formally authorizes the activity (such as reverse engineering or bypassing protective measures) to enhance its systems.

How to Submit a Vulnerability

To submit a vulnerability report to GLS Solutions LLC’s Product Security Team, please utilize the following email: security@gls.ai.

Preference, Prioritization, and Acceptance Criteria

We will use the criteria in the upcoming sections to prioritize and triage submissions.

What we would like to see from you:

Well-written reports in English will have a higher probability of resolution.
Reports that include proof-of-concept code equip us to better triage.
Reports that include only crash dumps or other automated tool output may receive lower priority.
Reports that include products outside our main scope may receive lower priority.
Please include how you found the bug, the impact, and any potential remediation.
Please include any plans or intentions for public disclosure.

What you can expect from GLS Solutions LLC:

A timely response to your email (within 5 business days).
After triage, we will send an expected timeline and commit to being as transparent as possible about the remediation timeline, as well as on issues or challenges that may extend it.
An open dialog to discuss issues.
Notification when the vulnerability analysis has completed each stage of our review.
Credit after the vulnerability has been validated and fixed.

If we cannot resolve communication issues or other problems, GLS Solutions LLC may bring in a neutral third party to help determine the best way to address the vulnerability.