Vulnerability and Threat Management Policy

This Vulnerability and Threat Management Policy describes the procedures used by WEB3 TREK, INC., operator of TrekO.ai, to identify, assess, monitor, prioritize, remediate, and respond to vulnerabilities and security threats affecting TrekO systems, cloud infrastructure, marketplace integrations, APIs, applications, and business operations.

1. Purpose

The purpose of this policy is to reduce cybersecurity risk by establishing procedures for identifying potential vulnerabilities and threats, evaluating their potential impact, implementing appropriate corrective actions, and monitoring TrekO.ai systems for security concerns.

2. Scope

This policy applies to systems, services, applications, infrastructure, and third-party integrations used by WEB3 TREK, INC. in support of TrekO.ai, including:

• TrekO.ai Marketplace.
• Firebase Authentication and Firestore.
• Render cloud infrastructure.
• Server-side applications and APIs.
• Marketplace OAuth integrations.
• Amazon Selling Partner API (SP-API).
• TikTok Shop APIs.
• Meta / Facebook APIs.
• Shopify APIs.
• eBay APIs.
• Etsy APIs.
• Payment and payout service integrations.
• Administrative and company endpoints.
• Other approved cloud and marketplace services.

3. Vulnerability Identification

WEB3 TREK, INC. monitors TrekO.ai systems and supporting services for known or suspected vulnerabilities through operational reviews, service-provider notifications, application testing, system logs, security alerts, software updates, and other appropriate security sources.

Potential vulnerabilities may be identified through:

• Cloud and service-provider security notifications.
• Software and dependency updates.
• Application and API errors.
• Authentication and access-control reviews.
• Security logs and operational monitoring.
• Marketplace platform security notices.
• User or administrator reports.
• Security testing and troubleshooting.

4. Threat Monitoring

WEB3 TREK, INC. monitors for security threats that could affect the confidentiality, integrity, or availability of TrekO.ai systems and data.

Threat monitoring may include:

• Unauthorized login or authentication attempts.
• Unexpected API activity.
• Access-control failures.
• Suspicious account activity.
• Credential or token exposure.
• Application errors indicating possible misuse.
• Cloud infrastructure security alerts.
• Marketplace or third-party service security notifications.

5. Vulnerability Assessment

Identified vulnerabilities are evaluated according to their potential impact on TrekO.ai systems, users, sellers, marketplace integrations, credentials, confidential information, and business operations.

Factors considered may include:

• Likelihood of exploitation.
• Potential exposure of sensitive information.
• Effect on authentication or authorization controls.
• Potential disruption of TrekO.ai services.
• Impact on marketplace or third-party integrations.
• Availability of patches or other remediation measures.
• Requirements imposed by marketplace or service providers.

6. Risk Prioritization

Security issues are prioritized according to their severity, likelihood, potential business impact, and the sensitivity of affected systems or data.

Issues involving authentication credentials, OAuth tokens, API secrets, administrative access, customer information, seller information, or critical production systems receive elevated priority.

7. Remediation

WEB3 TREK, INC. takes reasonable corrective actions to remediate identified vulnerabilities according to their severity and operational impact.

Remediation actions may include:

• Applying software or dependency updates.
• Updating application code.
• Changing system configuration.
• Restricting or removing unnecessary access.
• Rotating credentials, API keys, secrets, or OAuth tokens.
• Updating authentication or authorization controls.
• Disabling affected functionality when necessary.
• Coordinating remediation with cloud or marketplace service providers.

8. Credential and Secret Exposure

Suspected exposure of passwords, API keys, OAuth tokens, application secrets, administrative credentials, or other sensitive authentication information is treated as a security concern requiring prompt review.

Appropriate actions may include:

• Revoking affected credentials.
• Rotating keys or secrets.
• Terminating affected sessions or tokens.
• Reviewing related access activity.
• Restricting compromised accounts or services.
• Investigating the cause of the exposure.

9. Software and Dependency Management

Software libraries, application dependencies, cloud services, and third-party components used by TrekO.ai are reviewed and updated as appropriate to address security concerns, compatibility requirements, and service-provider changes.

Updates that address material security vulnerabilities are prioritized based on severity, system impact, and operational requirements.

10. Cloud and Third-Party Services

TrekO.ai relies on managed cloud, marketplace, payment, and API providers. WEB3 TREK, INC. reviews relevant security notices and service-provider updates and takes appropriate action when a vulnerability or threat affecting a third-party service may impact TrekO.ai.

Third-party providers remain responsible for the security of infrastructure and services under their control.

11. Access Control Reviews

Administrative permissions, service access, marketplace connections, credentials, and other privileged access are reviewed periodically to reduce unnecessary access and support the principle of least privilege.

Access that is no longer required may be removed, restricted, or updated.

12. Logging and Investigation

Application logs, authentication events, API responses, operational errors, and other available records may be reviewed when investigating suspected vulnerabilities or security threats.

Relevant findings may be documented to support troubleshooting, remediation, incident response, and future security improvements.

13. Incident Escalation

A vulnerability or threat that results in, or is reasonably suspected of causing, unauthorized access, data exposure, credential compromise, service disruption, or another security incident is handled according to the WEB3 TREK, INC. Incident Response Policy.

14. Marketplace and Partner Notifications

When required by applicable marketplace agreements, service-provider requirements, or law, WEB3 TREK, INC. may notify affected marketplace partners, service providers, sellers, customers, or appropriate authorities of confirmed security incidents.

15. Periodic Security Review

WEB3 TREK, INC. periodically reviews TrekO.ai security controls, authentication practices, application configurations, cloud services, marketplace integrations, access permissions, and operational procedures to identify opportunities to reduce vulnerability and threat exposure.

16. Policy Review

This Vulnerability and Threat Management Policy is reviewed at least once every six (6) months and updated whenever significant technical, operational, security, marketplace, or regulatory changes occur.

17. Contact

Questions or reports regarding vulnerabilities, security threats, or this policy may be directed to:

WEB3 TREK, INC.
Operator of TrekO.ai
Email: support@treko.ai
Website: https://treko.ai