Report a security vulnerability

What to include

• The affected page, form or endpoint, and what the vulnerability lets someone do.
• Clear steps to reproduce it. A short proof of concept helps.
• How we can contact you for follow-up questions.
• If you came across personal data, describe it instead of sending it to us.

Please write in English.

What we do

• We aim to acknowledge your report within five working days.
• We look into every report and aim to keep you updated until the issue is resolved.
• We aim to fix confirmed vulnerabilities as quickly as their severity requires, and to agree with you when details can be made public.

Scope

In scope: this website, including its pages, forms, the Ask MetaMatrix assistant and the public endpoints that serve them.

Out of scope:

• Services we use but do not run, such as Microsoft Azure, Microsoft 365 or Cloudflare. Please report those to the provider.
• Reports from automated scanners, or missing best-practice settings, without a demonstrated security impact.
• Denial-of-service, spam, social engineering and physical attacks.

Please do not

• access, change or delete data that does not belong to you, or keep more data than you need to show the issue;
• run tests that slow down or disrupt the website, or send large volumes of form submissions or AI questions;
• try to guess or brute-force passwords, or target our staff, clients or offices with phishing or other social engineering;
• share the vulnerability with others before we have fixed it, or ask for payment in return for your report.

Safe harbor

If you act in good faith and follow this policy, we will treat your research as authorised, we will not take legal action against you for it, and we will work with you to understand and fix the issue. This policy cannot authorise anything that breaks the law, or any testing of systems that belong to others.

Rewards

We do not run a paid bug bounty program, but we are grateful for every valid report.