Contact: mailto:security@agenticartists.com
Contact: https://twitter.com/agenticartists
Expires: 2027-08-01T00:00:00.000Z
Preferred-Languages: en
Canonical: https://agenticartists.com/.well-known/security.txt

# We welcome responsible disclosure. We do not run a paid bounty program but
# will publicly credit researchers who report valid issues.
#
# Scope:
#   - *.agenticartists.com
#   - API endpoints under /api/* on agenticartists.com
#
# Out of scope:
#   - pbs.twimg.com or any third-party CDN we hotlink
#   - Vercel infrastructure (report to Vercel directly)
#   - Self-XSS, denial-of-service, rate-limit bypass without proven impact
#
# Please include: reproduction steps, impact, and any screenshots/HTTP traces.
# We aim to acknowledge within 3 business days.