GENERAL CONDITIONS OF USE

2.1 Age and Legal Capacity

Registration on the Platform is restricted to individuals who have attained the age of majority (18 years or older) under the applicable laws of their country of residence. By registering, you represent and warrant that you meet this requirement. The Company reserves the right to request proof of age at any time.

2.2 Independence of Security Researchers

Security Researchers are independent individuals or entities. Nothing in these GCU creates or shall be construed to create any employer-employee relationship, agency, partnership, joint venture, or any other form of association between the Company and a Security Researcher. Security Researchers are solely responsible for their own tax obligations, social security contributions, professional registrations, and compliance with applicable Indian and international laws.

2.3 Authority of Customer Users

Individuals accessing the Platform on behalf of a Customer represent and warrant that they have full authority to bind the Customer to these GCU. All actions taken by Customer Users on the Platform are deemed to be actions of the Customer itself.

2.4 Conflict of Interest

Security Researchers must proactively disclose and avoid conflicts of interest with Customers whose Programs they participate in. Conflicts include but are not limited to: (i) current or former employment with the Customer within 12 months; (ii) holding a financial interest in the Customer; (iii) being a contractor or vendor of the Customer. Participation in a Program where a conflict exists is prohibited unless expressly authorized in writing by the Customer.

3.1 Account Creation

To access the Services, Users must complete the registration process on the Platform by providing accurate, complete, and current information. Users must select their account type at registration: Security Researcher or Organization. Additional role types (Mentor, ECS Reviewer, Vendor, Admin) are assigned by the Company.

3.2 Account Security

Users are solely responsible for maintaining the confidentiality of their login credentials. Any activity occurring under a User's account is deemed to be the User's own action. Users must immediately notify the Company at security@xc0mrade.com upon discovering any unauthorized access to or use of their account.

3.3 KYC Verification

Security Researchers wishing to receive monetary rewards must complete KYC verification as mandated by Indian financial regulations including the Prevention of Money Laundering Act (PMLA), 2002 and applicable RBI guidelines. KYC verification requires submission of government-issued photo identification, proof of address, and applicable tax documentation (PAN card for Indian residents). Payouts are strictly suspended until KYC is verified and marked as "KYC Verified" on the Platform.

3.4 Account Suspension and Termination

The Company reserves the right to suspend or permanently terminate any User account for: (i) violation of these GCU; (ii) suspected or confirmed fraudulent activity; (iii) submission of false or misleading information; (iv) actions that compromise Platform security or integrity; (v) conduct harmful to Customers, other Users, or the Company. Termination is without prejudice to the Company's right to seek damages.

4.1 Bug Bounty Programs

Bug Bounty Programs enable Customers to invite Security Researchers (publicly or privately) to test designated Systems in exchange for monetary Rewards. Security Researchers participating in Bug Bounty Programs acknowledge that:

• Testing must be strictly limited to in-scope assets defined in the Program.
• Rewards are determined solely by the Customer based on severity and validity of the Vulnerability Report.
• The Platform's P-Tier system (P3, P2, P1) governs access to private and high-value programs based on Sketch Score.
• The Sketch Score is updated automatically based on report outcomes as defined in Schedule A.

4.2 Vulnerability Disclosure Programs (VDP)

VDPs are non-monetary programs enabling Security Researchers to responsibly report Vulnerabilities to organizations. VDP participants receive no financial Reward and do not earn Sketch Score ranking points. Participation demonstrates good faith security research and supports the broader cybersecurity community.

4.3 Penetration Test Management (PTM)

PTM services allow Customers to manage structured penetration testing engagements through the Platform. Security Researchers participating in PTM engagements operate under a separate written agreement with the Customer and are subject to stricter confidentiality and scope requirements. PTM participants may be subject to background verification at the Company's discretion.

4.4 Attack Surface Management (ASM)

ASM is a Customer-facing continuous monitoring service. ASM findings are generated through automated scanning and must be validated by Customer Users before they are classified as confirmed Vulnerabilities. Security Researchers are not directly involved in ASM delivery.

4.5 zerod — Community Learning Platform

The zerod module provides Security Researchers with access to: (i) Capture The Flag (CTF) challenges; (ii) structured certification pathways; (iii) anonymized vulnerability case studies; (iv) mentorship programs. Participation in zerod activities contributes to a Researcher's Sketch Score through achievement of defined milestones. zerod content is the intellectual property of the Company and may not be reproduced or distributed without written permission.

4.6 Sketcher Tool

The Sketcher is the Platform's proprietary tool for creating structured visual representations of vulnerability exploit chains. By submitting a Sketch as part of a Vulnerability Report, the Security Researcher:

• Grants the Customer a non-exclusive, perpetual license to use the Sketch for internal security remediation purposes.
• Acknowledges that the JSON payload and PNG export generated by the Sketcher become part of the Vulnerability Report and are subject to the IP assignment provisions in Section 6.
• Represents that the Sketch accurately depicts the documented vulnerability and does not contain fabricated or misleading information.

5.1 Authorized Testing

Security Researchers may only conduct Tests on Systems expressly listed as in-scope in an active Program. The Customer's Program rules, read together with these GCU, constitute the binding Safe Harbor authorization for testing. Any testing conducted outside defined scope may constitute an offence under Section 66 of the Information Technology Act, 2000 and could result in civil or criminal liability.

5.2 Prohibited Conduct

Security Researchers must not, under any circumstances:

• Conduct or attempt Denial of Service (DoS) or Distributed Denial of Service (DDoS) attacks against any System.
• Access, exfiltrate, modify, or destroy data beyond what is strictly necessary to demonstrate the existence of a Vulnerability.
• Engage in social engineering, phishing, or physical attacks against Customer employees, contractors, or third parties.
• Access systems, accounts, or data belonging to any individual or entity other than test accounts expressly provided by the Customer.
• Demand payment or threaten public disclosure as a condition for providing Vulnerability information (extortion).
• Disclose any Vulnerability or Vulnerability Report to any third party, media outlet, or on social media without prior written approval from the Customer and the Company.
• Use discovered Vulnerabilities for personal gain beyond the Program's Reward structure.
• Submit knowingly false, fabricated, or duplicate reports.
• Violate any applicable Indian or international law in connection with security testing.

5.3 Responsible Disclosure

Upon discovering a Vulnerability, Security Researchers must submit the Vulnerability Report through the Platform within a reasonable timeframe. Disclosure timelines are governed by the Program rules and must not exceed the Customer's defined remediation period. Where no timeline is specified, the Company's default disclosure policy of 90 days from report acknowledgment applies.

5.4 Evidence and Report Quality

High-quality Vulnerability Reports must include: (i) a clear, descriptive title; (ii) the affected target or endpoint; (iii) the Security Researcher's severity assessment with CVSS justification; (iv) a detailed description of the Vulnerability; (v) quantified impact assessment; (vi) step-by-step reproduction instructions; and (vii) where applicable, a Sketcher-generated visual exploit chain. Low-quality, non-reproducible, or incomplete reports will result in Sketch Score deductions as per Schedule A.

6.1 Platform IP

The Company retains all intellectual property rights in the Platform, including but not limited to the Sketcher tool, Sketch Score algorithm, P-Tier system, zerod content, software, code, UI/UX design, databases, trademarks, and all proprietary methodologies. Users may not reproduce, adapt, distribute, or create derivative works from any Platform materials without prior written consent.

6.2 Vulnerability Report IP Assignment

Upon acceptance of a Vulnerability Report and payment of the associated Reward, the Security Researcher grants the Customer a non-exclusive, worldwide, perpetual, royalty-free license to use the Vulnerability Report (including reproduction steps and supporting materials) for internal security remediation, verification, audit, and compliance purposes.

The Security Researcher warrants that: (i) they are the sole author of the Report; (ii) the Report does not infringe any third-party rights; and (iii) the Report does not contain any open-source, third-party, or pre-existing IP without appropriate disclosure.

For clarity: assignment of rights applies only to the specific Sketch artifact generated and submitted for that accepted report. The underlying security know-how, methodology, and general research techniques remain with the Security Researcher.

6.3 Platform Data

Aggregated, anonymized, and statistical data generated through Platform usage, including Sketch Score data, program metrics, and vulnerability trends, is the exclusive property of the Company. Users have no ownership rights in Platform Data and may not extract, scrape, or reproduce it without written permission.

7.1 Rewards

Rewards are determined solely by the Customer based on the severity of the Vulnerability (as agreed between the Customer and Security Researcher) and the Program's reward table. The Company acts strictly as an intermediary and payment facilitator and is not liable for the non-payment, under-payment, or dispute of any Reward.

7.2 Platform Commission

The Company charges a platform commission on each Reward paid through the Platform. The commission rate applicable to each Program type is specified in the Customer's subscription agreement. Commissions are charged to the Customer as an overhead and are not deducted from the Security Researcher's Reward unless explicitly stated in the Program.

7.3 Wallet and Payouts

Rewards are held in the Security Researcher's Platform Wallet pending KYC verification and payout processing. Payouts are processed through the Platform's authorized PSP (Razorpay for Indian transactions; Stripe Connect / Payoneer for international). Currency conversion charges, where applicable, are borne by the Security Researcher. The Company shall provide Security Researchers with an annual transaction summary for tax reporting purposes.

7.4 Indian Tax Compliance

Security Researchers who are Indian residents are solely responsible for compliance with applicable Indian tax laws. The Company may deduct Tax at Source (TDS) as required under the Income Tax Act, 1961:

• Bug Bounty Rewards are treated as professional/contractual services income and withheld under applicable provisions such as Section 194C or Section 194J, as determined by prevailing law and transaction facts.
• The Company will issue Form 16A / TDS certificates as required by law.

The Company has obtained professional tax advice on classification and may update implementation as required by law. Security Researchers should obtain independent tax advice regarding their individual obligations (including GST where applicable).

7.5 Invoicing Mandate

By accepting these GCU, Security Researchers expressly authorize the Company to generate and issue invoices on their behalf for Rewards earned through Bug Bounty Programs. Security Researchers certify that they are aware of and will comply with all applicable social, tax, and accounting obligations. The Company's liability is strictly limited to providing transaction documentation.

All Users agree to maintain strict confidentiality of all information accessed through or in connection with the Platform, including Vulnerability Reports, Program details, Customer technical information, and any data encountered during testing. Confidentiality obligations survive termination of these GCU for a period of five (5) years.

Upon closure of a Program or termination of participation, Security Researchers must immediately delete all Customer data and information from their systems and, upon request, provide written confirmation of such deletion.

9.1 Data Controller

The Company processes personal data of Users as a data controller under India's Digital Personal Data Protection Act (DPDP), 2023. Details of data processing activities are available in the Platform's Privacy Policy at https://xc0mrade.com/privacy.

9.2 Security Researcher Data

Personal data collected from Security Researchers (including KYC documents, PAN details, transaction records) is processed strictly for the purposes of: (i) Platform operation and identity verification; (ii) Reward disbursement; (iii) legal compliance; and (iv) Sketch Score calculation. Data is not shared with third parties except as required by law or for payment processing.

9.3 Data During Testing

Security Researchers may encounter personal data belonging to Customer users during testing. Security Researchers must not access, copy, modify, or retain such data beyond what is strictly necessary to demonstrate the Vulnerability. All personal data encountered must be immediately reported to the Customer and treated as strictly confidential. Non-compliance constitutes a serious breach of these GCU and may trigger obligations under the DPDP Act 2023 and the IT Act 2000.

9.4 Data Subject Rights

Users may exercise their rights under the DPDP Act 2023 (including the right to access, correct, and erase personal data) by writing to: privacy@xc0mrade.com. The Company will respond within the timeframes mandated by applicable law.

10.1 Company Liability

To the maximum extent permitted by applicable Indian law, the Company shall not be liable for:

• Any damage caused by unauthorized activity conducted by Security Researchers outside the defined Program scope.
• Non-payment or disputes regarding Rewards between Customers and Security Researchers.
• Technical inaccuracies, errors, or omissions in Vulnerability Reports.
• Loss of data, business interruption, or consequential damages arising from Platform use.
• Platform unavailability due to maintenance, force majeure, or third-party infrastructure failures.
• Actions or omissions of Customer Users in managing their Programs.

10.2 Security Researcher Liability

Security Researchers are fully liable for all damage caused to the Company, Customers, or third parties resulting from: (i) testing conducted outside Program scope; (ii) unauthorized data access or exfiltration; (iii) breach of confidentiality; (iv) submission of false or malicious reports; or (v) any violation of applicable Indian or international law. Security Researchers agree to indemnify and hold harmless the Company and Customers from all claims, damages, costs, and expenses arising from such breaches.

10.3 Customer Liability

Customers are solely responsible for the accuracy and completeness of their Program scope definitions, the security of their own Systems, and ensuring that Security Researchers have lawful authorization to test designated assets. The Company shall not be liable for any damage arising from inadequately defined Program scopes.

The Company operates as an "Intermediary" under Section 2(w) of the Information Technology Act, 2000 and is subject to the Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021 as amended. In this capacity, the Company:

• Appoints a Grievance Officer accessible at grievance@xc0mrade.com for User complaints and data privacy concerns.
• Maintains a notice-and-takedown mechanism for unlawful content — content deemed unlawful (including exploit code targeting critical infrastructure) will be removed within 72 hours of notification.
• Conducts reasonable due diligence on Users but does not take editorial control over third party content (Vulnerability Reports).

Failure to maintain Intermediary compliance obligations, including the 72-hour takedown requirement for notified unlawful content, results in loss of safe harbor immunity under the IT Act. All Users must cooperate with the Company's compliance obligations.