Responsible disclosure
Report a security problem
We test AI agents for a living, so we want to hear when ours fail.
How
Email security@article11.ai with what you found, how to reproduce it, and what an attacker could do with it. We acknowledge every report within 48 hours.
Email security@article11.aiIn scope
article11.ai, the Article 11 APIs, the agent door, and our public MCP connector.
Especially wanted
Prompt injection that makes our agents act outside their authority, leaks of private memory, forged or altered receipts, and ways around the human checkpoint.
Out of scope
Denial of service and load testing, phishing or social engineering of people, physical attacks, and anything that touches other people's data.
Test fairly
Use only accounts and data you own; stop and tell us as soon as you reach private data, and don't keep it; give us reasonable time to fix before you publish.
Safe harbor
If you follow this policy in good faith, we will not threaten you or take legal action against you.
After you report
We confirm, fix, and publish what we learned once it is safe, with credit if you want it. No cash bounties right now.