Report a security problem

If you find a weakness in AiSSAY's software or on this website, tell us privately first. We would rather hear it from you than find it later.

How to report

Email hello@aissay.io with “Security report” in the subject line.

Please include:

• what you found, and where: the module, command or page;
• the steps to reproduce it, and the version you tested (the VERSION file in the release);
• what an attacker could do with it;
• how you would like to be credited, if at all.

What we commit to

• We acknowledge your report within five business days.
• We tell you whether we can reproduce it, and how serious we think it is.
• We give you an honest answer about whether and when it will be fixed, including “not soon” if that is true.
• We credit you in the fix notes if you want to be credited.
• There is no bug bounty. We do not pay for reports.

Disclosure

We ask for 90 days from your report before you publish, or less if a fix ships sooner. If we need longer, we will say why and ask. When a fix ships, we say what was wrong in the release notes.

Good-faith research

If you follow this policy, test only against your own installation, and stop once you have shown a problem, we will not treat your research as an attack or ask anyone to act against you for it.

In scope

• The AiSSAY software: the evidence store, the recording proxy, the MCP server, the browser extension and its native host, receipts and their verifier.
• This website, aissay.io.

Out of scope

• Testing against a store that holds anyone else’s real records. Use your own installation and made-up data.
• Denial-of-service testing, social engineering and physical attacks.
• Systems we do not run: your AI provider, your key manager, your hosting.

What we already say about our limits

We publish what our software does not do yet: the compliance framework pages name every gap, and the compliance and governance summary lists what is built, what is a seam and what is missing. No outside firm has tested this software yet. A report from you is the first independent look it gets.