Security · vulnerability disclosure
Report a vulnerability.
If you find a security problem in Spiron, tell us privately. We will not pursue research done in good faith under this policy.
- Report to
- security@spiron.ai
- Acknowledgement
- We aim for 3 business days
- Machine-readable
- https://spiron.ai/.well-known/security.txt
On this page5 sections
How to report
Email us, privately.
One monitored address for security reports.
Security
security@spiron.ai
Send your report to security@spiron.ai. Include what is affected (a URL, an API endpoint, or a feature), the steps to reproduce it, what you expected and what happened, and the impact you believe it has. Screenshots or a short proof of concept help.
Please do not post vulnerabilities, credentials, or anyone's data in a public place, and do not open a public issue. If you think a credential has leaked, rotate it first, then tell us.
Scope
What you may test.
Services Spiron runs on its own domain. Use only accounts and agents you created.
| What | Address |
|---|---|
| Website and dashboard | https://spiron.ai |
| API and channel webhooks | https://api.spiron.ai |
| Agents you create, and the chat surfaces they answer on | Your own workspace only |
- Out of scope
- Other customers’ accounts and data, denial of service or load testing, social engineering or phishing of our staff or users, physical attacks, and third-party services we use (report those to their owners).
- Low-value findings
- Missing security headers without an exploit, self-XSS, clickjacking on pages with no sensitive action, and rate limits on non-sensitive endpoints are usually not accepted as vulnerabilities.
Testing rules
Test without harming anyone.
- Only access, change, or delete data in accounts you own.
- Access no more data than you need to show the problem. If you reach someone else's data, stop, do not keep, use, or share it, and tell us.
- Do not use a vulnerability beyond confirming it, for example to move deeper into our systems or to keep access.
- Do not degrade the service for others, and do not spam other people.
- Do not try to make an agent act for someone who has not approved it, outside your own workspace.
- Give us a reasonable time to fix the issue before telling anyone else, and delete any data you obtained once you have reported it.
Safe harbour
Good-faith research is welcome.
Research that follows this policy is authorised, on the conditions below.
Safe harbour conditions
If you act in good faith and follow this policy, including the testing rules above, we consider your research authorised for the purposes of the Computer Misuse Act 1990, and we will not take legal action against you for it. For that research only, we waive the parts of our Terms of Service that would otherwise forbid it. If a third party brings a claim about research that followed this policy, we may make it known that you acted under it.
This safe harbour does not cover actions that break the testing rules or the law, and we cannot authorise testing of other companies' services or waive the rights of anyone else. We decide, acting reasonably, whether research followed this policy. If you are unsure whether something is allowed, ask us first. We may change this policy; the version published when you did the research applies.
We do not run a paid bounty program. Any reward or public credit is at our discretion, and we credit reporters only with their permission.
What happens next
Response times we aim for.
| Step | Target |
|---|---|
| We confirm we received your report | 3 business days |
| We tell you whether it is a vulnerability and how severe it is | 10 business days |
| We fix a critical issue | 30 days |
| Public disclosure, coordinated with you | After 90 days, or once a fix ships |
These are targets, not guarantees: the time a fix takes depends on the issue. We aim to keep you updated until it is resolved. The same contact is listed on the security page and in /.well-known/security.txt.
Next step
Read how Spiron protects your data.
The security page explains how secrets, access, isolation, and actions are handled.