Vulnerability disclosure program

Responsible research

Our program covers the TrueForge source repository and the TrueFoundry website, signup service, AI Gateway endpoints, and cloud services identified in this page’s scope. Test web applications and APIs at low request rates using accounts, tenants, API keys, and model or tool integrations you control. Assess authentication, authorization, tenant isolation, credential handling, and gateway controls without affecting other users. For TrueForge, prefer a local environment you control when examining session handling, approvals, sandbox boundaries, or file access, and report source-code findings privately.

Reporting

Submit vulnerability reports using the form on this program page. A useful report includes:

• The affected asset, endpoint, or source location, including relevant versions and deployment modes.
• Clear reproduction steps, prerequisites, and any account roles or configuration needed.
• The security impact and realistic attack scenario.
• Supporting evidence, such as sanitized requests, responses, logs, or screenshots, and suggested mitigations where available.

We aim to provide a first response within 5 days. Our contact address, security@truefoundry.com, is for questions about the program.

Prohibited testing

• Denial-of-service attacks, resource exhaustion, or automated scanning that degrades service.
• Social engineering, phishing, or attempts to deceive employees, users, or service providers.
• Physical attacks against people, facilities, or infrastructure.
• Spam, unsolicited messages, or abusive account creation.
• Accessing, altering, deleting, or retaining other people’s data beyond the minimum necessary to demonstrate an issue, including prompts, conversations, audit records, and credentials.
• Using gateway access, MCP tools, or sandbox execution to affect other users, external systems, or resources you do not control.

Safe harbor

We authorize good-faith research conducted in accordance with this policy and will not pursue or support legal action against researchers for that research. If a third party takes legal action concerning compliant research, we will make our authorization known.

Disclosure

Keep vulnerability details private until the issue is fixed, including by avoiding public repository issues or pull requests that expose the vulnerability. We aim to fix valid issues within 90 days and will coordinate any publication with you, providing credit if you wish to receive it.