# Threat.Blue

> Threat.Blue is the defensive security research and autonomous vulnerability remediation division of EarlyBird AI, LLC (https://oneearlybird.ai). Threat.Blue discovers reachable software vulnerabilities across source code, compiled binaries, firmware, and dependencies, proves each flaw deterministically inside an isolated ephemeral sandbox, and delivers regression-tested pull requests to authorized defenders.

Threat.Blue operates as `EarlyBird AI, LLC d/b/a Threat.Blue` under strict dual-use defensive governance. Every engagement requires verified organizational identity and written authorization (customer-owned repositories/binaries, signed Rules of Engagement, or sanctioned safe-harbor bug bounty programs). Reproduction harnesses run exclusively against isolated local builds (`127.0.0.1` / air-gapped sandboxes)—never against live third-party production networks. Client source code, binaries, and findings are never used to train AI models, and ephemeral workspaces are destroyed upon completion.

## Core Pages

- [Home — Turn Every Threat Blue](https://threat.blue/): Overview of the autonomous Find → Prove → Fix loop and enterprise briefing intake.
- [About Threat.Blue](https://threat.blue/about): Mission, technical methodology, who we serve, and corporate structure under EarlyBird AI, LLC.
- [Security, Governance & Coordinated Disclosure](https://threat.blue/security): Defensive-only charter, customer vetting, air-gapped ephemeral sandboxes, human-in-the-loop sign-off, and 90-day Coordinated Vulnerability Disclosure (CVD) policy.
- [Full Technical & Governance Context (llms-full.txt)](https://threat.blue/llms-full.txt): Complete single-file reference document covering Threat.Blue’s capabilities, security controls, legal terms, and parent organization.

## Legal & Data Protection

- [Terms of Service & Acceptable Use](https://threat.blue/terms): Contracting entity (`EarlyBird AI, LLC d/b/a Threat.Blue`), defensive authorization warranty, prohibited offensive uses, and IP ownership.
- [Privacy Policy](https://threat.blue/privacy): Zero-cookie, zero-third-party-tracker posture (`default-src 'none'` CSP), minimal briefing intake, and privacy rights.
- [Data Processing Addendum (DPA)](https://threat.blue/dpa): GDPR/CCPA processor obligations, Annex II technical and organizational security measures, 48-hour incident notice, 7-day post-engagement deletion, and sub-processors.
- [RFC 9116 security.txt](https://threat.blue/.well-known/security.txt): Machine-readable vulnerability disclosure contact (`mailto:security@threat.blue`) and policy URL.

## Parent Organization

- [EarlyBird AI, LLC](https://oneearlybird.ai): Parent company operating Threat.Blue (`EarlyBird AI, LLC d/b/a Threat.Blue`).
- [EarlyBird AI Security & Trust](https://oneearlybird.ai/security): Corporate security posture and governance of EarlyBird AI, LLC.