Security Policy

Last updated: 2026-06-01

Nomatica AI takes the security of its platform, its users, and its data seriously. This page describes how we handle vulnerability reports, the security SLAs we commit to, and the scope of the program.

Reporting a vulnerability

Please do not file a public issue. Send your report to security@nomatica.ai and encrypt sensitive attachments with the PGP key listed at the bottom of this page.

A high-quality report includes:

• A clear description of the issue and the impact
• A reproducible proof of concept (test script, curl commands, or a recorded session)
• The exact version, commit, or URL you observed the issue on
• Your expected response time, if any
• Whether you intend to disclose publicly, and on what timeline

Our commitments

Severity	First response	Status update	Target fix window
Critical (active exploit, data exfiltration, auth bypass)	≤ 4 business hours	Every 24 h	≤ 7 days
High (privilege escalation, significant data exposure)	≤ 1 business day	Every 3 days	≤ 30 days
Medium (limited impact, requires user interaction)	≤ 3 business days	Weekly	≤ 90 days
Low (hardening, defense in depth)	≤ 7 business days	Monthly	Next maintenance window

We follow coordinated disclosure. If you have a deadline, tell us in the report and we'll negotiate a timeline that works for both sides.

Scope

In scope:

• *.colorfulmoves.com (the production platform and its APIs)
• *.colorful-moves.com (the customer-facing web app)
• docs.colorful-moves.com (this site)
• The nomatica-security-sdk source repository and any tagged releases
• Auth flows: OAuth, email/passkey, password, JWT verification
• Payments: order creation, capture, refund, webhook integrity
• AI inference: prompt handling, output filtering, model isolation
• Cross-tenant data isolation in shared services

Out of scope:

• *.workers.dev URLs (these are explicitly disabled in production; any 200 response is itself a finding — please report)
• Denial-of-service attacks (we have separate capacity-protection controls; report to abuse@nomatica.ai instead)
• Social engineering of our employees
• Issues in third-party services we don't operate (e.g. payment processors, model providers)
• Newly disclosed zero-days in dependencies for which no upstream patch exists yet (we'll credit you in our next release notes)

Safe harbor

We will not pursue legal action against researchers who:

• Make a good-faith effort to avoid privacy violations, data destruction, or service disruption
• Only interact with accounts they own or have explicit permission to access
• Stop testing immediately if they encounter user data, and report it to us so we can clean up
• Do not exploit an issue beyond what is necessary to demonstrate it

Recognition

Researchers who follow this policy and report valid issues are credited in our release notes (unless they prefer to remain anonymous). High-impact reports are eligible for our bounty program, with rewards scaled to severity, impact, and report quality. Email security@nomatica.ai for the current reward schedule.

PGP key

Key ID:    0x9F4D 3A2C 6B71 EE08
Fingerprint: 4D8E 6B7A 1F2C 9E30  5A12 8B47 9F4D 3A2C 6B71 EE08
Email:     security@nomatica.ai
Expires:   2027-12-31

If you can't reach us by email (e.g. our mail server is in the path of the same outage you're reporting), the in-product Report a security issue link also reaches the team.