Vulnerability Disclosure Policy

Last updated: October 14, 2026.

Agent Auth Gateway (https://authgateway.getingeniousai.com) is operated by Ingenious AI. We are a security company — inviting and acting on reports is how we stay ahead. If you find a vulnerability in our service, we want to hear about it, and we will treat your report seriously.

How to report

Email avilanatanael640@gmail.com with "SECURITY:" in the subject line. Include:

• A description of the issue and the affected URL or endpoint.
• Steps to reproduce, including anything you used (curl commands, request/response pairs).
• The impact as you see it — what an attacker could do with this.
• Your name or handle and how we can reach you, so we can confirm the fix.

Please do not attach exploit payloads designed to persist or spread; a proof-of-concept that demonstrates the issue is enough.

What we promise

• Acknowledgment within 3 business days. We confirm every valid report by email.
• Assessment within 14 days. We tell you how we rate the issue and what we plan to do.
• Fix before disclosure. We ask that you give us reasonable time to fix the issue before any public disclosure, and we will keep you updated on progress.
• Credit if you want it. We are happy to credit good-faith researchers by name or handle in our changelog — or keep you anonymous, your choice.

Safe harbor

We will not take legal action against anyone who reports a vulnerability in good faith under this policy, provided you:

• Report it to us promptly and do not disclose it publicly before we have had a reasonable chance to fix it.
• Do not access, modify, or delete other users' data, and do not degrade the service for others.
• Do not use the vulnerability for any purpose other than demonstrating it to us (no fraud, no extortion, no data theft).

Scope

In scope: the Agent Auth Gateway web application and API at https://authgateway.getingeniousai.com, including authentication, billing/licensing flows, agent spend caps and policy enforcement, approval queues, kill switches, and the v1 proxy API.

Out of scope

• Denial-of-service testing or anything that degrades the service for other users.
• Spam, phishing, or social-engineering of our users or team.
• Physical attacks, or attacks on third-party services we depend on (hosting, payment, email providers) — report those to the relevant provider.
• Reports about missing best-practice headers or theoretical issues with no demonstrated impact.

Our own defenses

We run automated abuse detection on every platform, including honeypot endpoints that log and block scanner traffic. If your good-faith testing trips an automated block, tell us in your report and we will lift it immediately — an accidental block will never count against a legitimate disclosure.

Questions about this policy? Email avilanatanael640@gmail.com. You can also find our machine-readable contact in /.well-known/security.txt (RFC 9116).