On this page
At a glance
- Report security or privacy concerns to the team email with minimal necessary detail.
- The marketing website does not request microphone, camera or location access and does not connect to installed Ari.
- A reporting page is not permission to attack systems, access other people’s data or assume a bounty.
This overview helps you navigate the document. Read the full sections for the complete explanation.
Reporting a security concern
Email info@nightwingdigital.co with “Security report” in the subject. Identify the affected URL or version, the behaviour observed, a minimal safe reproduction and your contact details. Do not send passwords, working credentials, full customer records or a harmful executable. If a sensitive sample is essential, ask to agree a suitable transfer method first.
A useful report describes the impact and stops at the minimum evidence needed. Preserve another person’s privacy. We need enough detail to triage the concern. This reporting channel does not offer a payment, bounty, fixed response-time commitment or immunity from laws that we cannot waive.
Limits of security testing
This page does not authorise penetration testing or extend permission to third-party hosts, model providers, email services or customer installations. Do not perform denial-of-service testing, social engineering, credential attacks, destructive operations or access/exfiltration of another person’s information.
If you encounter private data unexpectedly, stop the activity, do not copy more than is necessary to report the issue and contact us. Separate written authorisation is needed for a scoped test that would otherwise exceed normal public use. Good-faith reports can be considered without granting an unlimited legal safe harbour.
Current website safeguards and boundaries
The current release uses HTTPS, same-origin form delivery, server-side validation, signed short-lived form tokens, a hidden abuse trap, rate limiting and request deduplication. Sending credentials are held on the server, not included in browser assets. These safeguards do not make a guarantee against every attack.
A content security policy restricts scripts, assets and connections to the intended self-hosted paths, while the browser permission policy blocks microphone, camera and geolocation for the marketing site. Legal text is static and readable without JavaScript; a separate lightweight script provides cookie settings without loading the main site’s 3D or scroll runtime. Neither a tour nor a demonstration orb grants device access.
Keeping an installed setup safe
Use current supported app and operating-system versions, protect the host Mac and pair only trusted devices. Limit workspace and service access to the task, review connected tools and remove unused credentials through their normal controls. Keep backups and verify an action’s actual result.
Treat source content as untrusted. A webpage or email claiming to be a system instruction should not cause secrets to be revealed or unrelated tasks to run. Report unexpected permission requests or tool behaviour through the product’s available controls and the team contact.
Incident handling and privacy requests
A reported incident needs assessment against the actual systems and records involved, proportionate evidence preservation, appropriate containment and compliance with applicable notification duties. The controls described on this page are not a claim of external certification or a penetration-test result.
For access, correction, deletion or another data-rights request, follow the Privacy policy rather than sending sensitive data as a vulnerability demonstration. A website request cannot itself erase records on an independently controlled Mac, phone or model account.
Document details
- Status
- Published
- Operator
- Nightwing Digital Solutions Co., Ltd.
- Company registration number
- 0105566075231
- Trading identity
- Ari · Nightwing Digital Solutions
- Country of registration
- Thailand
- Business/contact address
- 46/479 Precha uthit 12, Wiphavadi Rangsit road, Don Muang Subdistrict, Don Muang District, Bangkok 10210, Thailand
- Contact
- info@nightwingdigital.co
- Last reviewed
- 20 October 2026
- Effective date
- 20 October 2026