Vulnerability disclosure

Last updated: October 18, 2026

If you have found a security problem in Openwake, in the sensors, the API, the portal or the site, we want to hear about it, and we will not take action against anyone who reports one in good faith under this page.

Where to write

security@openwake.ai. A signed message is welcome but not required. If a report contains data that is not yours, say so and do not include more of it than the report needs. Our contact is also published at https://openwake.ai/.well-known/security.txt.

What to expect from us

• An acknowledgment within two business days, with the name of the person handling it.
• Our assessment of severity within seven days, and a fix for anything critical within seven days of confirming it.
• A note when the fix ships, and credit here by name or handle if you want it.
• No legal action for research done under this page: testing against your own accounts and organizations, no

reading or changing of other people's data, no denial of service, no social engineering of our people, and a reasonable time for us to fix the problem before it is made public (ninety days from acknowledgment, or sooner once the fix ships).

In scope

openwake.ai, portal.openwake.ai, api.openwake.ai, the Scout for Endpoint agent and its installers, the Scout for Browser extension, and the integrations we ship. Our subprocessors (listed at /legal/subprocessors) run their own programs; a problem in one of them should go to them, and we will help you reach the right place.

Out of scope

Reports from automated scanners with no demonstrated impact, missing headers or records with no demonstrated impact, rate limits on sign-in codes behaving as designed, and anything that needs physical access to a machine.

What we do not pay

We do not run a bug bounty today. We say so here so nobody is surprised; credit and a direct line to the people who built it are what we offer.