Vulnerability Disclosure & Bug Bounty

• We acknowledge new reports within 3 business days.
• We provide an initial assessment (triage) within 7 business days.
• We keep you updated on remediation progress and let you know when the issue is fixed.
• We won't pursue or support legal action against researchers acting in good faith under this policy.

If you make a good-faith effort to comply with this policy during your research, we will consider your actions authorized, will not initiate legal action against you, and will work with you to understand and resolve the issue quickly. This authorization does not extend to actions that harm Agent21, our customers, or third parties (e.g., data destruction, service disruption, or accessing more data than necessary to demonstrate the issue).

• agent21.ai and its subdomains, and the Agent21 web application.
• The Agent21 public API (/api/v1/*) and the Agent21 Slack app.
• Authentication/authorization flaws, tenant-isolation bypass, injection, SSRF, RCE, and sensitive-data exposure.

• Findings from automated scanners without a demonstrated, exploitable impact.
• Denial-of-service (DoS/DDoS), volumetric, or rate-limit testing.
• Social engineering, phishing, or physical attacks against Agent21 staff or facilities.
• Vulnerabilities in third-party services we integrate with — report those to the respective vendor.
• Missing best-practice headers or email (SPF/DKIM/DMARC) config without a concrete exploit.

• Only test against your own account/data or accounts you have explicit permission to test.
• Do not access, modify, or delete other customers' data. Use the minimum access needed to prove an issue.
• Do not publicly disclose the issue until we've confirmed it is resolved.

Agent21 runs a private, invitation-based bug bounty. For valid, in-scope reports we offer recognition (with your permission, a place in our security researcher acknowledgements) and, at our discretion, monetary rewards scaled to the severity and impact of the finding. Reward eligibility and amounts are determined solely by Agent21. To keep the program fair: the first researcher to report a previously unknown, reproducible issue is eligible, and duplicates or already-known issues are not.