Vulnerability Disclosure Policy

This policy was last updated in September 2026.

How to report

Email security@praesidia.ai with enough detail for the issue to be reproduced and validated. A useful report includes:

• The affected asset, such as a URL, API endpoint, SDK, or hostname.
• A clear description of the issue and its potential impact.
• Reproduction steps, a non-destructive proof of concept, or a short screen capture.
• The accounts, tenants, and identifiers used, limited to accounts and data you own.

Machine-readable contact details are available at /.well-known/security.txt. If a report needs sensitive supporting material, say so in the first email and ask for an encrypted delivery channel before sending it.

Disclosure expectations

We ask reporters to give us a reasonable opportunity to remediate before public disclosure and to coordinate timing with us.

Praesidia does not currently operate a paid bug-bounty program.

Systems covered by this reporting channel

• praesidia.ai and its subdomains.
• app.praesidia.ai and the Praesidia dashboard.
• Praesidia's public API and MCP endpoints.
• Praesidia SDKs and command-line tools distributed to customers.

Keep testing safe

• Test only accounts, tenants, systems, and data you own.
• Stop after confirming the issue; do not access, modify, retain, or disclose another customer's data.
• Do not perform denial-of-service, volumetric, social-engineering, phishing, or physical attacks.
• Do not submit automated-scanner output without a reproducible security impact.
• If customer data is encountered unexpectedly, stop testing and report the event immediately.

Contact

Send security reports to security@praesidia.ai. For non-security questions, use the contact details on the About page.