Vulnerability disclosure

Scope

This policy covers the PromptLeash website and the PromptLeash software, including software deployed in a customer's environment. Do not test inside a customer's environment without that customer's authorisation. Third-party services and physical security are out of scope.

How to report

If you believe you have found a security vulnerability, please report it by emailing security@promptleash.ai.

What to include

Please provide a clear description of the vulnerability, including the affected URL or component, steps to reproduce, and any supporting materials such as proof-of-concept code or screenshots. Include your name and contact details so we can follow up if needed.

Good-faith safe harbour

PromptLeash will not take legal action against individuals who discover and report vulnerabilities in good faith, in accordance with this policy, and who do not access or destroy data beyond what is necessary to demonstrate the vulnerability. We ask that you make a reasonable effort to avoid violating privacy, destroying data, or disrupting our services.

Acknowledgement

We will acknowledge receipt of your report. We do not commit to a response time. We may contact you if we need more detail.