Security

Reporting a vulnerability

If you believe you've found a security issue, send the technical details to [email protected]. If you'd like to encrypt your report, ask in plain text first and we'll exchange a key — we don't currently publish a static PGP key.

Please include: a clear description, the affected URL or component, reproduction steps, expected vs. observed behaviour, and your contact info. We aim to acknowledge within 1 business day and to triage within 3.

Scope

In-scope assets:

• coagentic.work and all subdomains
• api.coagentic.work
• The Coagentic SDK and CLI in this repo
• Hosted customer sites under *.coagentic.site (production traffic begins at launch).

Out of scope:

• Third-party services we integrate with (Polar, Resend, Twilio, …)
• Issues caused exclusively by misconfiguration on a customer's connected provider
• Self-XSS, missing security headers without a working PoC, rate-limit research without business impact
• DoS / volumetric attacks — please don't run them

Safe harbor

We won't pursue legal action against researchers who:

• Stay within the scope above.
• Don't access, modify, or destroy data that isn't theirs.
• Don't run service-degrading attacks (DoS, brute force at scale, mass scanning).
• Give us a reasonable window to fix before publishing.

If you act in good faith and follow the rules above, your activity is authorised under our acceptable-use policy and the Computer Fraud and Abuse Act / equivalent laws — we will publicly say so on request.

Recognition

Coagentic is pre-revenue today, so we don't yet pay cash bounties. What we do offer for unique, reproducible reports against in-scope assets:

• Hall-of-fame attribution (with your consent).
• A written acknowledgement you can include in your portfolio / CV / disclosure write-up.
• Coagentic credit toward paid tiers — 1, 3, or 12 months depending on severity.

We may launch a monetary bounty programme later as paid plans ramp. Reports submitted today are recognised in the ways above; cash rewards are not retroactive.

Hall of fame

Researchers who've helped us harden the platform. Listed with consent — names go up after the fix ships and you confirm you'd like attribution.

• (empty for now — be the first)

What we do on our side

• HTTPS everywhere, HSTS, modern TLS, signed cookies, CSP on hosted sites.
• bcrypt password hashing, optional TOTP 2FA.
• Per-tenant rate limits on hot endpoints (Redis sliding window).
• Billing webhook signature verification (Polar standard webhooks v1) + idempotent event log.
• Outbound webhooks signed HMAC-SHA256.
• Automated dependency scanning (Dependabot + Renovate); we aim to ship critical patches within 7 days of disclosure.
• Per-user audit log for privileged actions.

We're happy to walk a security researcher through the relevant parts of the codebase on request.