RegisteredBrands.AI (operated by RootVaultAI LLC) is a trust infrastructure platform where security is foundational. If you've discovered a vulnerability in our systems — including our APIs, cryptographic implementations, payment flows, or AI agent interfaces — we want to hear from you.
Effective Date: March 3, 2026
As a platform that handles cryptographic identity, USDC payments, and AI agent verification, we hold ourselves to the highest security standards. Every vulnerability report is treated with urgency, transparency, and respect for the researcher.
We acknowledge every valid report within 24 hours. You'll receive a tracking ID and a dedicated point of contact from our security team.
We keep you informed at every stage — from triage to patch to public disclosure. No black holes, no silence.
Researchers who report valid vulnerabilities are credited in our security advisories (with your permission) and may be eligible for monetary rewards based on severity.
Email [email protected] with a detailed description of the vulnerability. Include steps to reproduce, affected endpoints or components, proof-of-concept code, and the potential impact. For cryptographic or payment-related issues, include the specific algorithm, contract address, or transaction flow affected.
Within 24 hours, we'll confirm receipt, assign a severity rating (Critical / High / Medium / Low), and provide a tracking ID. Payment and cryptographic vulnerabilities are automatically escalated to Critical triage.
Our engineering team investigates the report, develops a fix, and deploys it. For critical issues affecting payments or cryptographic integrity, we target a 24-hour resolution window. For other critical issues, 72 hours.
Once the fix is deployed, we notify you, publish a security advisory if appropriate, and credit you as the discoverer (with your permission). Monetary rewards are determined based on severity and impact.
Issues in our USDC payment verification, including: bypassing on-chain verification, spoofing transaction hashes, manipulating payment amounts, or activating entitlements without valid payment.
Weaknesses in our Ed25519 implementation, canonical JSON serialization, signature verification bypass, key management, or entitlement token forgery vectors.
Methods by which AI agents could abuse verification endpoints, bypass rate limits, manipulate trust scores, or exploit the approval queue to execute unauthorized actions.
We consider security research conducted in accordance with this policy to be authorized, lawful, and helpful. We will not pursue legal action against researchers who:
If legal action is initiated by a third party against you for activities conducted in accordance with this policy, we will take steps to make it known that your actions were authorized under our responsible disclosure program.
| Severity | Acknowledgment | Resolution Target | Examples |
|---|---|---|---|
| Critical | < 4 hours | 24–72 hours | Payment bypass, key compromise, auth bypass |
| High | < 12 hours | 7 days | Trust score manipulation, rate limit bypass |
| Medium | < 24 hours | 30 days | Information disclosure, CSRF |
| Low | < 24 hours | 90 days | Minor UI issues, verbose errors |
Send your report to our security team. Include reproduction steps, affected endpoints or components, and any proof-of-concept code. For payment-related issues, include transaction details.
Security is foundational to trust. If you're building AI agents that transact autonomously, your brand's integrity starts with verifiable identity.
Protect Your Brand — Register a Capsule