pencil ai

Coordinated Vulnerability Disclosure Policy

Our commitment

We take the security of Pencil seriously and welcome reports from researchers who find problems. If you report a vulnerability to us in good faith and follow this policy, we will work with you to understand and fix it, and we will not take action against you.

Safe harbor

When you act in good faith and within this policy, we consider your research authorized. We will not pursue or support legal action against you for it, and if a third party brings a claim about research that followed this policy, we will make clear that it was authorized. This does not cover other people's systems, and we cannot bind third parties. If you are unsure whether something is covered, ask us first.

Guidelines

  • Test only against accounts and data you own or have permission to use. Do not access, change or keep other people's data. If you encounter some by accident, stop and tell us.
  • Use the least access needed to show the problem. Stop once you have proof.
  • Do not degrade the service for others.
  • Give us a reasonable time to fix the issue before sharing details publicly, and talk to us first about timing.
  • Do not demand payment or conditions in return for a report.

Scope

In scope

  • The pencilton.com website and its subdomains that we operate.
  • The Pencil Harness, once it is released.

Out of scope

  • Denial-of-service and volumetric testing.
  • Social engineering or phishing of our team or users.
  • Physical attacks on offices, equipment or people.
  • Reports that are only the output of an automated scanner, without a demonstrated impact.
  • Third-party services we use but do not control. Please report those to the vendor.

Issues about how a model behaves, such as unwanted output, are not security vulnerabilities in the sense of this policy. Send those to hello@pencilton.com.

How to report

Email hello@pencilton.com. Please include:

  • a short summary of the issue;
  • the affected asset, such as a URL or component;
  • steps to reproduce it;
  • the impact you believe it has;
  • how we can contact you.

Our machine-readable contact details are in security.txt.

What to expect

  • We will acknowledge your report within 3 business days.
  • We will keep you updated as we assess and fix the issue.
  • If you would like credit once it is fixed, we will name you or your handle. If you prefer to stay anonymous, we will respect that.

No bug bounty at this time

We do not currently offer monetary rewards for reports. We are grateful for them all the same.