Report a security issue
If you think you found a vulnerability in Coral or Coral Hub, tell us. We read every report we receive.
How to report
Please include:
- What you found, and where: the page, the command or the feature.
- The steps to repeat it, as short as you can make them.
- What an attacker could do with it, as far as you know.
- Your name or handle, if you want to be credited.
Please do not include other people’s data in the report, and please do not attach real credentials.
Reports to support@subgentic.ai with a subject starting SECURITY are read by the Coral Hub operator.
What we ask of you
- Test only against your own account, your own computer and your own data.
- Do not read, change or delete data that belongs to other users.
- Do not run anything that slows the service down for others, such as floods of requests.
- Give us a reasonable time to fix the problem before you publish it.
What is in scope
Vulnerabilities in Coral, in Coral Hub and in this website are in scope. These are not:
- Social engineering of our staff, and physical attacks.
- Denial-of-service attacks.
- Output from an automated scanner, with no demonstrated effect.
A problem in a service run by someone else, such as the sign-in, mail, payment or cloud providers we use, is best reported to them. When you have shown the problem, stop: do not keep access, and do not take more data than you need to prove it.
What we promise
- We keep you updated while we look into it and when it is fixed.
- We credit you in our notes about the fix if you want that, and keep your name out if you do not.
We do not run a bug bounty at the moment, so we cannot pay for reports.
Find this in machine-readable form
The same contact is in our security.txt.