Report a security issue.

Scope

This policy applies to the following systems and services:

• The ManticoreAI web application at manticore.ai and its subdomains
• ManticoreAI APIs and backend services
• ManticoreAI-owned infrastructure directly supporting customer-facing services

The following are not in scope:

• Third-party services and applications integrated with ManticoreAI
• Findings from physical testing (e.g., office access, tailgating)
• Findings derived primarily from social engineering (e.g., phishing)
• Findings from applications or systems not listed above

Issues we don't accept

The following issue types are generally considered out of scope:

• Clickjacking on pages with no sensitive actions
• CSRF on forms available to anonymous users (e.g., contact forms)
• Missing security headers that do not lead to a direct vulnerability
• Missing best practices without demonstrable security impact
• Use of known-vulnerable libraries without a working proof of concept
• Rate limiting or brute force issues on non-authentication endpoints
• SPF/DKIM/DMARC configuration issues without demonstrated impact
• Content injection without demonstrated security impact
• Vulnerabilities requiring unlikely user interaction

How to Report

When reporting a vulnerability, please include the following information:

• A description of the vulnerability and its potential impact
• Step-by-step instructions to reproduce the issue
• Any proof-of-concept code, screenshots, or logs
• The affected URL, endpoint, or component
• Your assessment of the severity (Critical, High, Medium, Low)
• Your contact information for follow-up questions

Send reports to security@manticore.ai. We don't publish a PGP key, so don't put customer data, credentials or session tokens in the email. Describe what you found and we'll agree a secure way to share it.

Guidelines

When conducting security research, you must adhere to the following guidelines:

• Only test against accounts you own or have explicit permission to test
• Do not access, modify, or delete data belonging to other users
• Do not perform denial-of-service (DoS/DDoS) attacks
• Do not perform actions that could degrade the experience for other users
• Do not engage in social engineering of ManticoreAI employees or customers
• Do not publicly disclose vulnerabilities before they have been resolved
• Stop testing and report immediately if you encounter sensitive user data

Safe Harbor

ManticoreAI commits to the following for researchers who act in good faith:

• We will not pursue legal action against researchers who comply with this policy
• We will work with you to understand and resolve the issue
• We consider activities conducted consistent with this policy to constitute "authorized" access under applicable law
• If legal action is initiated by a third party against you for activities conducted in compliance with this policy, we will make this authorization known

We consider good faith security research to be activity that is:

• Authorized under this Vulnerability Disclosure Policy
• Limited to the scope defined in this policy
• Reported to us in a timely manner
• Not used for personal financial gain beyond any bug bounty program we may offer

What to Expect

After you submit a report, you can expect the following:

• Acknowledgment: We will acknowledge receipt of your report within 3 business days
• Assessment: Our security team will evaluate the report and determine its validity and severity
• Updates: We will keep you informed of our progress as we work to resolve the issue
• Resolution: We aim to resolve critical vulnerabilities within 30 days and will notify you when a fix is deployed
• Recognition: With your permission, we publicly acknowledge your report once the vulnerability is resolved