Last updated: 24 June 2026. Working draft for review prior to publication.
Attack Insights takes the security of our systems, our platform, and our customers seriously. We welcome reports from security researchers and members of the public who identify potential vulnerabilities in our services, and we are committed to working with you to verify and resolve them responsibly.
Scope
This policy applies to internet-facing systems owned and operated by Attack Insights, including https://attackinsights.ai and the Attack Insights platform. Third-party services we use are out of scope and should be reported to the relevant provider.
How to report a vulnerability
Please email us at security@attackinsights.ai with enough detail to reproduce and assess the issue, including: the affected URL or system, a description of the vulnerability, steps to reproduce, and any proof-of-concept. We support coordinated disclosure and will acknowledge your report as quickly as we reasonably can.
Our commitments
If you make a good-faith effort to comply with this policy during your research, we will: acknowledge receipt of your report; work with you to understand and validate the issue; keep you informed of our progress; and not pursue or support legal action against you in relation to your report.
Guidelines for researchers
To act in good faith, please: only test against systems in scope; avoid privacy violations, data destruction, and degradation of our services; do not access, modify, or retain data that does not belong to you; do not run denial-of-service or spam tests; and give us a reasonable time to remediate before any public disclosure.
Out of scope
The following are generally not eligible: reports from automated scanners without a demonstrated, exploitable impact; missing best-practice headers or configurations without a concrete vulnerability; social engineering or phishing of our staff; and physical attacks.
Safe harbour
Activities conducted consistently with this policy will be considered authorised conduct, and we will not recommend or pursue legal action related to your research. If legal action is initiated by a third party against you for activities conducted under this policy, we will make this authorisation known.
security.txt
A machine-readable contact will also be published at https://attackinsights.ai/.well-known/security.txt. [Add the security.txt file during implementation.]
Contact
Security contact: security@attackinsights.ai.