Report a Security Issue
If you think you have found a security problem in Prompt SecOps or Necio, we want to hear about it. This page explains how to report it, what is in scope, and what we promise in return.
How to report
Email [email protected] with “Security” in the subject line. Tell us what you found, where you found it, the steps to reproduce it, and the impact you think it has.
Please include only the minimum data needed to show the problem. Never send us other people’s personal data.
In scope
promptsecops.com, promptsecops.ai, necio.app and its API, and the Necio Assist browser extension.
Out of scope: third-party services we use (such as Stripe, Supabase, Vercel, Cloudflare and Formspree), which you should report to the vendor; the chatbots and AI apps that our customers test with Necio; and automated scanner output with no demonstrated impact.
Please don’t
Run denial-of-service or load tests. Access, change or delete data that is not yours: create your own account to test with. Use phishing or social engineering against our team or customers. Disclose the issue publicly before we have fixed it, or before 90 days have passed since your report, whichever comes first.
What we promise
We will reply within 5 business days, keep you updated while we fix the issue, and credit you publicly if you would like.
Safe harbor: if you make a good-faith effort to follow this policy, we will consider your research authorized and will not take legal action against you for it.
We do not run a paid bug bounty at this time.