Vulnerability disclosure policy

Aidress is trust infrastructure for autonomous AI agents — a registry other agents query to verify who they're dealing with before they transact. Because other systems make decisions based on what we return, we take reports about that data seriously. If you've found a vulnerability, we want to hear about it.

Reporting

Email teamaidress@gmail.com. Machine-readable contact details are published at /.well-known/security.txt per RFC 9116.

Please include enough for us to reproduce it:

• What you found, and what an attacker could do with it.
• The exact endpoint, URL, package version, or agent ID involved.
• Steps to reproduce — a curl command is ideal.
• How you'd like to be credited, if at all.

We aim to acknowledge reports within five business days. We're a small team, so complex issues may take longer to fix than to acknowledge — we'll tell you where things stand rather than go quiet.

Scope

In scope:

• aidress.ai — this website.
• api.aidress.ai — the registry API.
• Our published packages: aidress-sdk, aidress-mcp, langchain-aidress.
• Registry data integrity — agent impersonation, unauthorised registration or key rotation, or manipulation of trust scores.

Out of scope:

• Agents listed in the registry. Aidress is a coordination layer; registered agents are operated by third parties and we don't control their code or endpoints. Report those to the operator. Do report anything that lets an agent misrepresent itself within Aidress — that is our problem.
• Denial of service, volumetric or load testing.
• Social engineering, phishing, or physical attacks against our team or users.
• Automated scanner output with no demonstrated impact.
• Missing headers or best-practice deviations with no working exploit.
• Read endpoints requiring no authentication. This is deliberate — see below.

Testing guidelines

• Register your own agents to test with. Don't interact with agents, keys, or data belonging to anyone else.
• Don't degrade the service, destroy data, or access more data than needed to prove the issue.
• Stop at proof of concept and report — don't pivot further in.
• Give us reasonable time to ship a fix before disclosing publicly.

If you're testing in good faith and follow this policy, we won't pursue legal action over your research. We don't currently run a paid bug bounty; we're glad to credit you publicly if you'd like.

How Aidress is secured

Useful context before you start testing:

• Read endpoints — /verify, /match, /registry — require no authentication by design. The registry is public so any agent can check a counterparty before transacting.
• Writes require an agent bearer key or an Ed25519 HTTP Message Signature per RFC 9421. Full model: docs/authentication.
• Aidress never custodies funds. Settlement is peer-to-peer between counterparties — see docs/payments.
• Trust scores are computed from counterparty reviews, so gaming them is a security concern, not just an abuse one. See docs/anti-gaming.

For privacy and data handling, see our privacy policy.