Responsible disclosure
How to report a vulnerability, the response times you can expect, and what is in and out of scope.
If you find a vulnerability in arcy.js or the ARCY platform, email contact@arcyai.com.
- Initial response: within 48 hours.
- Triage and resolution: within 7 days for a confirmed issue.
Do not disclose a vulnerability publicly until we have had time to assess and patch it.
Safe harbor. If you make a good-faith effort to follow this policy, report through the email above, and avoid the excluded targets and methods below, we will not pursue legal action against your research.
In scope. The ARCY platform API, arcy.js, the sites at arcyai.com and its subdomains, authentication and authorization bypasses, cross-workspace data access, and any vulnerability caused by how ARCY configures or integrates a third-party provider, for example a misconfigured storage bucket or a broken check on a Clerk-issued identity.
Out of scope, by target. The platforms of our providers themselves: Amazon Web Services (AWS), Clerk, Resend, Stripe. Report a vulnerability in one of those to them, not to us. A bug in how we use one of them is always in scope.
Out of scope, by method. Denial-of-service testing, physical security testing, and social engineering techniques such as phishing our staff or talking a support agent into an action. A finding about a weak support or account-recovery process is welcome and in scope; describe it rather than test it against real employees or customers without our prior authorization.