Vulnerability disclosure
Help us keep Agent Relay and its users safe.
Report a vulnerability
Email security@agentrelay.com or use GitHub private security reporting. Please include the affected product, version or URL, potential impact, and steps to reproduce or a proof of concept. Keep reports private and omit unnecessary personal data and credentials.
We aim to acknowledge reports within two business days, provide an initial assessment within ten business days, and keep you informed until resolution.
Scope
Agent Relay Cloud and hosted services under agentrelay.com, Desktop and CLI releases, and open-source repositories in the AgentWorkforce GitHub organization are in scope.
Social engineering, physical attacks, denial-of-service testing, automated scanner findings without demonstrated impact, and third-party services we do not operate are out of scope. Report upstream vulnerabilities to the upstream project.
Good-faith research and safe harbor
We will not pursue legal action for good-faith research that avoids privacy violations, data destruction, and service disruption; uses only accounts you own or have explicit permission to test; and does not access or retain other users' data beyond what is needed to demonstrate the issue.
Give us reasonable time to fix an issue before public disclosure. We aim for coordinated disclosure within 90 days and will discuss timing with you.
Recognition
We do not currently run a paid bug bounty. With your permission, we can credit your contribution publicly.
See our trust page for current product controls and readiness gaps.