Report a weakness.

Responsible disclosure

Email security@agentics.you. That inbox is read. Tell us what you found, where it is, and how to see it again. A short proof is enough.

We will acknowledge your report within 72 hours and keep you posted while we fix it. Please give us a reasonable time to fix it before you tell anyone else.

We will not pursue legal action against someone who acts in good faith, avoids privacy violations, destruction, and service disruption, and only uses the data needed to show the issue.

Scope

In scope: the memory service and the ways in.

• The memory API: /v1/memories and every path under it
• The MCP endpoint at /mcp, which Connect uses (/docs/mcp/)
• Sign-in and accounts: /api/auth and every path under it
• The console at /console/

Out of scope:

• Vaults, the attestor and the claim API. They are switched off.
• x402 payments. They do not run on mainnet.
• Denial-of-service testing, social engineering, physical attacks, and third-party services we do not run.

Bug bounty

We pay for a valid finding in scope. A finding is valid when we can see it again from your report and it is a real weakness in code we ship. Duplicate reports, already-public issues, and tests that only describe a worry are not paid.

No independent audit has been done yet. Vaults are not live on mainnet. This page does not charge a card.

Paid only if found. Cap $5,000 until the first mainnet deposit.