AgentDNA Get A Demo
Security

Report a vulnerability

We take the security of AgentDNA, and of the agents that run through it, seriously. If you've found a weakness, please tell us privately so we can fix it before anyone else finds it.

What's affected
Severity, as you see it *
Details
Reproduce
Contact

Leave your email blank to report anonymously, though we won't be able to follow up.

Reports go privately to the AgentDNA security team. See our Privacy Policy.

Disclosure policy

Scope

We welcome reports about any AgentDNA property, including:

  • The website, agentdna.io, and the documentation at docs.agentdna.io
  • The AgentDNA Dashboard and its APIs
  • The Python SDK (agent-dna) and our open-source repositories

Especially interesting to us: ways to bypass an agent's verified identity (GRADE), get access an agent shouldn't have (CBAC), or alter or hide a record on the Provenance Layer.

Out of scope

  • Denial-of-service or load testing, and spam
  • Social engineering or phishing of our team, and physical attacks
  • Reports from automated scanners without a demonstrated impact
  • Missing best-practice headers or settings with no practical exploit
  • Issues in third-party services we don't control

Testing rules

  • Only test against accounts and data you own, or that you have permission to use.
  • Don't access, change or delete other people's data; stop and report as soon as you find you can.
  • Don't degrade the service for others.
  • Give us a reasonable chance to fix the issue before you share it publicly.

What to expect

We'll confirm we've received your report, look into it, and keep you updated as we work on a fix. If you'd like credit when the issue is resolved, tell us how you'd like to be named.

Safe harbour

If you make a good-faith effort to follow this policy, we'll treat your research as authorised, work with you to understand and fix the issue, and won't take legal action against you for it.