Reporting a vulnerability.

How to report

If you believe you have found a vulnerability in GAIP, send a description to agents@gaipagents.com or through the contact page: the affected URL or route, the steps to reproduce, what you observed and when. Please do not include personal data, secrets or other people's information, and please do not open a public GitHub issue for a vulnerability.

Scope

• www.gaipagents.com and its API, MCP and A2A endpoints
• GAIP's Railway runtime (gaip-agent-to-art-prototype-production.up.railway.app)
• GAIP's own code and GitHub Actions workflows that run those services

Out of scope: third-party services GAIP links to or observes (report those to their operators), denial-of-service or load testing, social engineering.

Please

• Test only with your own requests against public endpoints.
• Do not access, change or delete data that is not yours, and do not degrade the service (no load testing or high-volume automated scanning; the public rate limits apply to every caller).
• Allow reasonable time for a fix before any public disclosure.

What GAIP does with a report

GAIP aims to acknowledge a report within 5 working days. This is a best-effort target, not a guarantee: GAIP is run by one founder, who reads every report. GAIP investigates it and fixes what it confirms; fixes that change public behaviour are recorded in the changelog. There is no bounty or payment.