Responsible disclosure

Found something? Tell us.

We would rather hear it from you than from a customer. Report anything below and we will acknowledge within two working days, tell you what we found, and credit you unless you would rather we did not.

Report it

What we are most interested in

In rough order of how much it would keep us up at night:

Anything crossing the tenancy boundary. One organisation reading another’s calls, reports or keys. This is the one that matters most — a multi-tenant carbon product that shows one customer another’s AI spend does not get a second chance.
Authentication and session handling. Signing in as somebody else, keeping a session that should have ended, or claiming an invitation not addressed to you.
Anything that writes telemetry into an organisation you do not hold a key for, or that lets a sender choose which key it is attributed to.
Injection, deserialisation, or remote execution anywhere.
Anything that exposes an API key beyond the one moment it is shown.

Things you do not need to tell us

Not because they do not matter, but because we already know and would rather not waste your time:

The forms are rate limited per source and globally, with a signed render-timestamp and a honeypot. There is deliberately no CAPTCHA: it would stop bots rather than spend, and the obvious one is Google’s, which would profile every visitor to this page and hard-block the Tor and VPN users most likely to be reporting something. The limit fails open — if our database is unreachable your report still sends, because silently rejecting reports during an incident is the worst possible time to be strict.
We store a salted hash of your IP address for a day to make that limit work, never the address itself. It is enough to count and useless for anything else.
Missing security headers on the marketing pages, absent an exploit that uses them.
Reports produced by a scanner with no working proof of concept.
Social engineering, physical access, or anything requiring a compromised device.

What is not defended, because it cannot happen

Worth knowing before you spend time looking. The wire model has nowhere to put a prompt or a completion: the collector strips anything that could carry content before it leaves your process, and the ingest schema is strict, so an unknown field is rejected rather than stored. There is no prompt data to leak because none is ever received.

Likewise, API keys are stored only as a SHA-256 hash and a short prefix. There is no reveal endpoint and no recovery path, because there is genuinely nothing to reveal. A report that a key can be read back would be very interesting indeed, and we do not believe one exists.

Both claims are checkable rather than asserted — the collector is Apache-2.0 and on GitHub (opens in a new tab).

What we commit to

Acknowledge within two working days.
Tell you our assessment, including when we disagree that it is a vulnerability.
Not pursue or support legal action against anyone acting in good faith under this policy, including accessing only their own data and stopping as soon as they have demonstrated the issue.
Credit you by name or handle, or not, entirely as you prefer.

We do not run a paid bounty. Saying so plainly beats leaving it ambiguous and disappointing somebody after the work.