Bubba AI, Inc. 2261 Market Street, San Francisco, California, 94114 Scope and L imitation While the assessment was conducted with the highest level of diligence and adherence to industry best practices, the following limitations applied to the scope of this penetration test: Restricted Scope Boundaries : Only the assets, systems, IP ranges, applications, and functionalities explicitly listed in the agreed ‑ upon scope were tested. Any components not included in the defined scope were excluded from assessment. Time and Resource Constraints : The penetration test was performed within a fixed timeframe and with limited resources. As a result, not all potential attack paths or complex chained exploit scenarios may have been fully explored. Snapshot in Time : The results reflect the security posture of the environment at the time of testing. Changes to systems, configurations, deployments, or infrastructure after the engagement may introduce new vulnerabilities not captured in this report. Third-Party Components : External services, SaaS platforms, or hosted components managed by third parties were not tested unless specifically authorized and included in the scope.