Vulnerability Disclosure Policy

Classification: Public Effective Date: 1 April 2026 Last Updated: 1 April 2026

1. Introduction

GTMSAI Ltd, trading as Pebbles Ai ("we", "us", "our"), is committed to the security of our platform, our users, and their data. We recognise that independent security researchers play a valuable role in helping us maintain a high standard of security across our services.

This Vulnerability Disclosure Policy provides guidelines for security researchers to conduct vulnerability discovery activities against our systems in a responsible manner. It describes which systems and activities are in scope, how to submit vulnerability reports, and what you can expect from us in return.

We welcome reports from anyone, including individual researchers, industry organisations, and vendors. We value the work of the security research community and are committed to working with reporters who identify vulnerabilities in good faith.

2. Guidelines for Security Researchers

We ask that you:

a. Notify us promptly. Report any real or potential security issue to us as soon as possible after discovery.

b. Allow reasonable time for resolution. Provide us a reasonable period to investigate and remediate the issue before any public disclosure. We ask for a minimum of 90 days from the date of your report.

c. Minimise harm. Make every effort to avoid privacy violations, degradation of user experience, disruption to production systems, and destruction or manipulation of data.

d. Limit exploitation. Only use exploits to the extent necessary to confirm a vulnerability's presence. Do not use an exploit to compromise or exfiltrate data, establish persistent access, or pivot to other systems.

e. Protect sensitive data. If you encounter any sensitive data (including personal data, financial information, or proprietary information), stop your test immediately, notify us, and do not retain, copy, or disclose the data.

f. Act in good faith. Do not submit a high volume of low-quality reports. Each report should describe a distinct, verifiable vulnerability.

g. Stay within scope. Only test systems and services listed in the Scope section below.

3. Authorization and Safe Harbor

Security research carried out in conformity with this policy is considered authorised conduct. We commit to the following safe harbor provisions:

• We will not initiate or recommend legal action against researchers who discover and report vulnerabilities in good faith and in accordance with this policy.
• We will consider activities conducted consistent with this policy to be authorised access under the Computer Misuse Act 1990 (UK) and other applicable computer fraud and abuse laws.
• We will work with researchers to understand and resolve reported issues promptly.
• If legal action is initiated by a third party against a researcher for activities that were conducted in accordance with this policy, we will make this authorisation known.

We will not seek damages from researchers who cause unintentional harm during good-faith testing conducted in accordance with this policy, provided the researcher promptly reports the incident and cooperates with remediation.

This safe harbor applies only to legal claims under the control of GTMSAI Ltd and does not bind independent third parties.

This policy is governed by and construed in accordance with the laws of England and Wales.

4. Scope

4.1 In-Scope Systems

This policy applies to the following systems and services:

• app.trypebbles.ai -- the Pebbles Ai web application
• www.trypebbles.ai -- the Pebbles Ai marketing website
• Pebbles Ai API endpoints -- any API served under trypebbles.ai domains
• Pebbles Ai mobile applications -- when available on iOS and Android

4.2 Out-of-Scope Systems

The following are explicitly out of scope and must not be tested:

• Third-party services and integrations, including but not limited to Google Workspace, Slack, HubSpot, Stripe, SendGrid, LinkedIn, and any other external service that Pebbles Ai integrates with. Vulnerabilities in third-party services should be reported directly to the respective vendor under their own disclosure policy.
• Infrastructure managed by Google Cloud Platform, including GKE clusters, Cloud SQL instances, load balancers, and other GCP-managed services.
• Social media accounts and any platform presence outside of trypebbles.ai domains.

If you are unsure whether a system or endpoint is in scope, contact us at security@trypebbles.ai before beginning your research.

5. Prohibited Testing Types

The following types of testing are not authorised under any circumstances:

a. Denial of Service (DoS/DDoS). Network or application-layer denial-of-service testing.

b. Social engineering. Phishing, vishing, smishing, or any form of social engineering targeting Pebbles Ai employees, contractors, or users.

c. Physical testing. Physical access attempts to offices, data centres, or any other facilities (e.g., tailgating, lock picking).

d. Automated mass scanning. High-volume automated scanning that may degrade service availability or user experience.

e. Spam or unsolicited messaging. Sending unsolicited messages to users or employees as part of testing.

f. Data destruction or modification. Any action that intentionally destroys, corrupts, or modifies data belonging to Pebbles Ai or its users.

6. Reporting a Vulnerability

To report a security vulnerability, send an email to:

security@trypebbles.ai

• Reports may be submitted anonymously. However, providing contact information allows us to communicate with you about the status and resolution of your report.
• If you wish to encrypt your report, contact us at the address above to request our PGP key.
• Please submit reports in English where possible.
• Personal information provided in vulnerability reports will be processed by GTMSAI Ltd for the purpose of investigating and resolving the reported vulnerability, on the basis of our legitimate interest in maintaining the security of our platform. For further details, see our Privacy Policy.

7. What to Include in a Report

To help us investigate and respond effectively, we recommend including the following information in your report:

a. Vulnerability description. A clear explanation of the vulnerability and its type (e.g., XSS, IDOR, SSRF).

b. Place of discovery. The affected URL, endpoint, API route, or application component.

c. Potential impact. An assessment of the possible impact if the vulnerability were exploited (e.g., data exposure, account takeover, privilege escalation).

d. Reproduction steps. Detailed, step-by-step instructions to reproduce the vulnerability. Include scripts, screenshots, HTTP requests/responses, or proof-of-concept code where possible.

e. Environment details. Browser version, operating system, or any relevant configuration used during testing.

8. Response Timelines

We are committed to responding to vulnerability reports in a timely manner:

If we determine that additional time is needed beyond 90 days, we will communicate this to you along with a revised timeline and explanation.

9. Our Commitment

When you report a vulnerability to us in good faith, we commit to:

• Transparent communication. We will keep you informed about the status of your report through acknowledgement, triage, and resolution.
• Timely acknowledgement. We will confirm receipt of your report within 3 business days.
• Good-faith engagement. We welcome dialogue about reported issues and are willing to discuss concerns or questions.
• Credit and acknowledgement. With your permission, we will acknowledge your contribution in our communications. If you prefer to remain anonymous, we will respect that choice.
• No retaliation. We will not take adverse action against researchers who report vulnerabilities in compliance with this policy.
• Continuous improvement. We use vulnerability reports to improve the security of our platform and will apply lessons learned broadly.

10. security.txt

In accordance with RFC 9116, we maintain a security.txt file at:

https://app.trypebbles.ai/.well-known/security.txt

The security.txt file provides machine-readable security contact information and references this Vulnerability Disclosure Policy. It includes:

• Contact: security@trypebbles.ai
• Policy: A link to this Vulnerability Disclosure Policy
• Preferred-Languages: en

Contact

For any questions about this policy, please contact:

Security Team Email: security@trypebbles.ai

Data Protection Officer: data@trypebbles.ai

GTMSAI Ltd 82 Wandsworth Bridge Road, London, United Kingdom, SW6 2TF Trading as Pebbles Ai