Security Research Ethics Policy

Effective: July 28, 2026 · FAVZ Group · Wyoming, USA

Our Commitment

AIZA-Hextyx is built on the belief that AI systems should be rigorously tested before they are trusted — and that rigorous testing must be done responsibly, ethically, and with proper authorization.

This policy describes the ethical principles that govern AIZA's design, our expectations for how users conduct security research with our platform, and our commitment to the security research community.

1. The Authorization Principle

Security research without authorization is not security research — it is unauthorized access. AIZA is designed from the ground up around this principle:

Every scan requires an Authorization Attestation ID
Every scan submission is logged with the user's identity and the stated authorization
AIZA cooperates fully with law enforcement when our platform is misused

We built this architecture because we believe the security research community is best served by tools that make proper authorization easy and non-compliance obvious — not tools that make authorization optional.

2. Measurement, Not Exploitation

AIZA's scan engine is built on a measurement-first philosophy. Every test phase uses one of the following approaches:

PoE Marker Detection: Rather than embedding attack payloads in test content, AIZA embeds a harmless confirmation token (AIZA-HEXTYX-POE-CONFIRMED). If the token appears in the target system's response, the injection channel is confirmed — without any harmful content being delivered.

Degradation Scoring: Rather than measuring whether a safety bypass succeeded, AIZA measures whether the target system's response quality degrades when attack framing is applied. The finding is the degradation, not the bypass.

Observable Property Measurement: Rather than attempting to extract training data, AIZA measures observable surface properties — entropy patterns, PII-format content in generated outputs, response consistency — that indicate risk without performing actual extraction.

This means AIZA does not contain, generate, or deliver jailbreak payloads, harmful content instructions, or bypass strings. Our codebase is regularly audited against this standard.

3. Responsible Disclosure Support

If a user discovers a genuine vulnerability in a third-party AI system through authorized use of AIZA, we encourage them to:

Document the finding using AIZA's report exports (STIX 2.1 and MITRE ATT&CK formats are particularly useful for communicating findings to vendors)
Contact the affected vendor through their security disclosure process or security@[vendor].com
Allow reasonable remediation time — typically 90 days for AI system vulnerabilities, following industry norms
Consider coordinated disclosure with relevant Computer Emergency Response Teams (CERTs) for critical vulnerabilities

AIZA's report formats are designed to support professional vulnerability disclosure. The STIX 2.1 export in particular is widely accepted by enterprise security teams and government CERTs.

4. Our Research Ethics

What AIZA Does Not Do

AIZA does not: - Conduct research on AI systems without the consent of their operators - Attempt to extract or reproduce training data from any AI system - Publish specific bypass techniques or working exploits - Share scan findings from user engagements with any third party - Use user scan data to improve our own detection capabilities without explicit consent

What AIZA Does

AIZA does: - Publish general research on AI security measurement methodology - Contribute to standards bodies developing AI security frameworks (MITRE ATLAS, OWASP LLM Top 10) - Responsibly disclose novel AI security vulnerabilities we discover in our own research - Cooperate with government agencies developing AI safety and security standards - Support the academic security research community through responsible information sharing

5. The AI Security Research Community

AIZA recognizes and supports the broader AI security research community. We believe that:

Security research that follows authorization and responsible disclosure norms is legitimate and valuable
AI vendors benefit from having their systems tested by skilled researchers
The community is self-regulating through norms, reputation, and professional standards
Tools like AIZA should make good security research easier, not serve as force multipliers for bad actors

We welcome collaboration with researchers, security consultants, AI vendors, and standards bodies. Contact us at research@hextyx.com.

6. Reporting Ethics Concerns

If you believe AIZA is being used in a manner that violates these ethics principles — or if you have concerns about AIZA's own practices — contact us:

Ethics concerns: ethics@hextyx.com Security disclosures about AIZA itself: security@hextyx.com

We take ethics reports seriously and will respond within five (5) business days.

7. A Note on the Security Research Community

The tools we build reflect the values we hold. AIZA exists because we believe the AI security research community needs professional-grade tooling that meets the standards enterprises and regulators expect — rigorous, authorized, documented, and defensible.

If you are using AIZA to make AI systems more secure, with proper authorization, and with appropriate care for the data you handle along the way — that is exactly what this platform is for.

— The AIZA-Hextyx Team