How to report a vulnerability
Email support@uug.ai with “Security report” in the subject. Please include:
- the product and version, or the URL, that is affected;
- the steps to reproduce the issue, with a proof of concept if you have one;
- the impact you expect, for example access to recordings or accounts;
- how we can reach you, and whether you want to be credited.
For our open-source repositories you can also use GitHub's private vulnerability reporting, for example at kerberos-io/agent. Please do not report vulnerabilities in public GitHub issues.
Scope
This policy covers:
- Agent, Vault, Hub, and Factory, including our open-source repositories on GitHub;
- our websites uug.ai and learn.uug.ai;
- services we run for customers.
Out of scope are denial-of-service tests, social engineering, physical attacks, spam, and reports from automated scanners without a demonstrated impact.
What we do with your report
- We confirm that we received your report within three working days.
- We assess it and tell you what we plan to do within ten working days.
- We keep you informed until the issue is fixed and agree a disclosure date with you.
- With your permission, we credit you in the release notes or advisory.
Guidelines for researchers
We will not take legal action against research that is done in good faith and follows these guidelines:
- Only test against your own installation or accounts you own.
- Do not access, change, or delete data that is not yours. If you reach personal data such as recordings, stop and report it.
- Do not disrupt our services or those of our customers.
- Give us reasonable time to fix the issue before you disclose it.
We do not run a paid bug bounty programme.
Machine-readable contact
This policy is also published as security.txt (RFC 9116).