Vulnerability disclosure

Last updated October 12, 2026

If you find a security vulnerability in Conare, tell us. This page covers what's in scope, how to report a vulnerability, how to test, and what we commit to.

Scope

  • conare.ai, including the console.
  • api.conare.ai, including the REST API and the MCP server.
  • Packages we publish, including the conare SDK on npm.

We care most about anything that lets one organization read, change or delete another organization's data, gets past sign-in or API key checks, or exposes credentials.

Out of scope

  • Services run by other companies that Conare uses. Report those to the company that runs them.
  • Denial of service, load testing and high-volume automated scanning.
  • Social engineering, phishing and physical attacks.
  • Output from automated tools without a demonstrated impact.
  • Missing security headers, cookie flags, TLS settings or DNS records (SPF, DKIM, DMARC, DNSSEC, CAA) without a working exploit.
  • Clickjacking or CSRF on pages and forms with no sensitive action, including sign-in and sign-out.
  • Issues that only affect outdated browsers or operating systems.

How to report

Email security@conare.ai, one issue per email. Text in the body of the email helps us more than attachments. Please include:

  • what the vulnerability is and what an attacker could do with it;
  • steps to reproduce it, or a proof of concept;
  • the URLs, requests or package versions involved.

Don't include anyone else's data in a report. If you need an account to test with, ask at the same address.

How to test

  • Use only accounts and organizations you own or have permission to use.
  • Don't access, change or delete data that isn't yours. If you reach someone else's data, stop, tell us, and delete what you kept.
  • Use a vulnerability only as far as you need to show it exists.
  • Don't degrade the service for anyone else.
  • Follow the law.

What we commit to

  • We acknowledge your report within 3 business days.
  • We tell you within 10 business days whether we've confirmed the issue and what we plan to do.
  • We keep you updated until it's fixed and tell you when it is.
  • We don't share your name or contact details without your permission.

Disclosure

Please don't make an issue public until we've fixed it or 90 days have passed since your report, whichever comes first. If a fix needs longer, we'll tell you why and agree a date with you.

Safe harbor

If you act in good faith and follow this policy, we consider your research authorized. We won't take legal action against you or report you to law enforcement for it. We waive the parts of our Terms of Service that would otherwise prohibit research done under this policy, such as the limits on reverse engineering and automated access.

If a third party takes legal action against you over research done under this policy, we'll make it known that you followed it. If you're unsure whether something is allowed, ask us first.

Rewards

Conare doesn't run a bug bounty program and doesn't pay for reports.