In scope
- akilabs.tech and its subdomains that we operate;
- the Ask Aki website assistant and its server endpoint;
- Aki Horizon environments that we host, where we have given you access.
Systems run by customers, partners or third-party providers (for example, our hosting or email provider) are out of scope. Please report issues in those to their owners.
Out of scope
- denial-of-service, load or volumetric testing;
- social engineering, phishing or physical attacks against our staff or premises;
- spam, or reports from automated scanners without a demonstrated security impact;
- missing best-practice headers or settings with no practical exploit;
- making the AI assistant say something unhelpful or off-topic, unless it exposes data, credentials or other users' information.
Please do
- give us enough detail to reproduce the issue: affected URL or component, steps, and impact;
- use only accounts and data you own, and access no more data than you need to show the problem;
- stop and report as soon as you confirm a vulnerability;
- keep the details confidential until we've fixed it or agreed a disclosure date with you (we suggest 90 days).
Please don't
- access, change, delete or keep data that isn't yours;
- disrupt our services or degrade them for other users;
- use a vulnerability beyond what is needed to confirm it, or move to other systems;
- demand payment in exchange for not disclosing an issue.
What you can expect from us
| Step | Our target |
|---|---|
| Acknowledge your report | Within 3 working days |
| Initial assessment and severity | Within 10 working days |
| Progress updates | At least every 15 working days until resolved |
| Public credit (if you'd like it) | Once the issue is fixed |
We don't currently run a paid bug bounty. We are grateful for every good-faith report and happy to credit researchers publicly.
Safe harbour
If you act in good faith and follow this policy, we will consider your research authorised, will not pursue legal action against you, and will not report you to law enforcement for it. If a third party takes action against you over research that followed this policy, we will make it clear that your work was authorised by us. This commitment covers only systems we own and operate.
If you're unsure whether something is allowed, email us first and ask.