1. Our commitment
Security research makes our software and our websites safer for everyone who uses them, and we welcome it. If you find a vulnerability, tell us privately and give us time to fix it. We will work with you in good faith, keep you informed, and credit you if you would like.
2. Safe harbor
If you make a good-faith effort to follow this policy, we will consider your research authorized, we will work with you to understand and fix the problem quickly, and we will not pursue or support legal action against you for it. If anyone else brings legal action against you for research done under this policy, we will make it known that we authorized it.
If you are unsure whether something you want to try is allowed, ask us first.
3. Guidelines
Under this policy, please:
- tell us as soon as you can after you find a vulnerability;
- test only on accounts, computers and data that are yours, or that their owner has allowed you to use;
- do only what you need to show the problem, and keep no access afterwards;
- stop as soon as you reach anyone else’s data, keep none of it, and tell us what you saw;
- give us 90 days to fix the problem before you share anything about it publicly, unless we agree on another date.
Please don’t:
- run denial-of-service tests, or anything else that slows or breaks our sites or services for others;
- use social engineering, such as phishing, on anyone at Elovaren, or test our premises or equipment in person;
- send spam, or scan automatically at a volume that loads our sites.
4. Scope
In scope:
- Our software, on any computer it runs on: a command or tool that runs without the question the software says it asks; a rule in an organization’s policy file that does not hold; a password, key or other secret that gets out past its safeguards; a model request that reaches an endpoint the software says it refuses; how it installs and updates itself; and what it keeps on your computer. Prompt injection that leads to any of these is in scope too.
- Our websites: elovaren.com, hexinfra.com and mgam.bio.
Out of scope:
- services that others run and that our software or our sites use, such as model providers, OpenRouter, search services, package registries and our web host. Please report flaws in them to them. If the flaw is in the way our software uses one of them, it is in scope.
- what a model says, when no security boundary is crossed. Tell us about it all the same, at contact@elovaren.com.
- findings without a working attack, such as missing headers, email settings, or the output of an automated scanner.
- attacks that need full control of the computer, or the computer itself, to begin with.
5. How to report
Write to contact@elovaren.com with “Security” in the subject. Please include where the vulnerability is (the software’s version and the system it runs on, or the web address), what it lets someone do, and the steps to reproduce it, with any code or screenshots. You don’t need to give your name.
6. What you can expect
- We will confirm that we have your report within five business days.
- We will tell you whether we can reproduce the problem, and keep you informed while we fix it.
- We will tell you when it is fixed and, with your permission, thank you by name when we say so publicly.
- We do not pay rewards for reports at this time.
7. Changes
If this policy changes, the date at the top changes with it. The same contact details are at /.well-known/security.txt, for tools that look for them there.