Security & responsible disclosure

We would rather hear about a problem from you than read about it later. Good-faith security research is welcome here, and we will not pursue it.

How to report

Email brian@makemysandbox.com with what you found, how to reproduce it, and any impact you can see. Plain email is fine; a proof of concept helps but is not required. We aim to acknowledge within five business days and to keep you posted until it is fixed.

Scope

agentcycore.ai and its subdomains, including the hosted application. Please test only against accounts and data you own or that we have set up for you. Out of scope: denial of service, spam, social engineering of our people, and anything that requires touching another customer’s data — if your line of inquiry heads there, stop and tell us instead.

Safe harbor

If you make a good-faith effort to follow this policy when researching and reporting, we will consider your research authorized, we will not pursue legal action, and we will work with you to understand and resolve the issue quickly. This is a good-faith program: there is no bounty today. We are glad to credit you by name in a fix note if you would like the credit.

Our practice

Customer data lives in one managed Postgres database, isolated per tenant with row-level security forced on every table; an automated tenancy probe runs on every release. Secrets scanning runs in CI on every change, and we run a documented internal security review on a quarterly cadence. Findings from this page feed the same review.