Responsible Disclosure

Mycroft helps companies secure their systems and prove it, so we hold our own security to the same standard. If you believe you have found a security vulnerability in Mycroft's platform, we want to hear from you. This policy explains how to report it, what we ask of you, and what you can expect from us.

If You Are a Mycroft Customer

If you think your account has been compromised or you have noticed suspicious activity in it, contact Mycroft Support or email security@mycroft.io.

How to Report a Vulnerability

Use the form below to submit your report. The rest of this policy follows the form, so please read it first.

Do not include passwords, API keys, session tokens, or other people's data in your report. If we need sensitive evidence or screenshots to understand the issue, we will arrange a secure way to share them.

You may report anonymously, but we can only follow up if you give us a way to reach you.

What You Can Expect From Us

When you report in good faith under this policy, we will:

• Acknowledge your report.
• Investigate it and tell you whether we were able to confirm the issue.
• Work to fix confirmed vulnerabilities in a timeframe that reflects their severity.
• Let you know when a reported issue has been resolved, where we are able to.

What We Ask of You

• Test only against accounts you own or have explicit permission to use.
• Do not access, change, or delete data that does not belong to you. If you come across someone else's data, stop, do not copy or share it, and tell us in your report.
• Do not degrade or interrupt our services or anyone else's use of them.
• Use only as much access as you need to demonstrate the issue, and do not use it to move further into our systems.
• Contact us for permission before running automated scanners, and keep any approved scanning low in volume.
• Keep the details confidential until we have fixed the issue or 90 days have passed since your report, whichever comes first, unless we agree on a different date with you. Please tell us before you publish, and leave out any data that does not belong to you.

Testing That Is Not Allowed

• Denial of service attacks or volumetric testing.
• Social engineering or phishing of Mycroft employees, contractors, customers, or partners.
• Physical testing of offices, equipment, or data centers.
• Attacks against other users, or the use, sale, or trading of stolen credentials.
• Malware, ransomware, or anything designed to persist on our systems.

Scope

In scope:

• app.mycroft.io
• api.mycroft.io
• mcp.mycroft.io

Out of scope: Services run by third parties, even when they appear under a Mycroft name or subdomain, and any system not listed above. This policy does not give you permission to test third-party services. If you find an issue in one, please report it to that provider. If you think it affects Mycroft's customers, you are welcome to tell us as well.

If you are not sure whether something is in scope, ask us at security@mycroft.io before you test it.

Safe Harbor

If you make a good faith effort to follow this policy, we will consider your research authorized and will not bring legal action against you for it. For that research, we also waive any restriction in our Terms that would otherwise prohibit it, and we will not suspend or terminate your account because of it. If a third party brings legal action against you over research that followed this policy, we will make it known that your work was authorized under this policy.

This policy does not authorize testing of systems we do not own or control, and we cannot give permission on behalf of third parties. You remain responsible for complying with applicable law.

Rewards

Mycroft does not currently run a paid bug bounty program, and we do not offer payment for vulnerability reports.

Related Information

See our Trust Center, Privacy Policy, and Terms.