Geist
Book a demo
Security disclosure

Report a vulnerability

If you believe you found a security issue in Geist or a service we operate, report it privately. Do not open a public issue.

Email a security reportSecurity & Trust
Private reporting

Send the report directly to us.

Use the address below for suspected vulnerabilities. Do not include credentials, personal data, or unrelated production data.

Security contact

We do not currently operate a paid bug bounty program.

Scope

Supported targets

This policy covers the current production service and code that Geist operates or maintains.

In scope

  • geist.company, app.geist.company, and api.geist.company when operated by Geist
  • The current production deployment
  • The main branch of this repository for authorized collaborators
  • Authentication, tenant isolation, APIs, agent tools, file handling, and deployment controls

Out of scope

  • Old commits, unsupported releases, forks, and customer-modified deployments
  • Third-party services that Geist does not operate
  • Social engineering, physical testing, denial-of-service, spam, and high-volume scanning
  • Scanner-only reports or missing headers without a demonstrated security impact
Research rules

Prove the issue without expanding the harm.

Testing is authorized only while you follow these rules and applicable law.

Required conduct

  • Use only accounts, tenants, devices, and data you own or are authorized to test.
  • Stop after the minimum proof needed to demonstrate the vulnerability.
  • Stop immediately if you encounter another person’s or organization’s data.
  • Preserve evidence without copying, changing, deleting, or publicly sharing sensitive data.
  • Contact us before continuing if you are unsure whether a test is safe or in scope.

Do not

  • Exfiltrate data, establish persistence, move laterally, or escalate access beyond the minimum proof.
  • Disrupt availability, degrade service, send bulk traffic, or consume material resources.
  • Use malware, phishing, credential attacks, or tests against employees and suppliers.
  • Access, modify, or delete data belonging to another tenant.
  • Publish vulnerability details before coordinated disclosure is agreed.
Report quality

Include enough evidence to reproduce and assess the issue.

A concise, complete report gets to the right owner faster.

  1. Affected URL, component, API, version, or commit
  2. Vulnerability type and the security boundary you expected
  3. Reproduction steps or a minimal proof of concept
  4. Required account role, permissions, configuration, and other preconditions
  5. Observed and realistic potential impact
  6. Sanitized request IDs, logs, responses, screenshots, or timestamps
  7. Whether you encountered sensitive data and whether you retained any copy
  8. Your preferred contact details and disclosure expectations
Our response

What you can expect

We will keep the reporter informed while we validate and remediate the issue.

Acknowledgement

Within 2 business days

We confirm receipt and provide a tracking reference.

Initial triage

Within 5 business days

We assess scope, severity, reproducibility, and the affected owners.

Status updates

At least every 14 days

We explain what changed and what remains under investigation.

Remediation

Risk-based

We prioritize exploitability and impact. We do not promise a fixed resolution date before triage.

Coordination

Good-faith research and disclosure

If you act in good faith, follow this policy, and make a reasonable effort to avoid harm, we will treat your research as authorized under this policy and will not initiate legal action over that research. This does not authorize conduct prohibited by applicable law or by systems outside our control.

Coordinated disclosure

Please allow us a reasonable opportunity to investigate and deploy a fix before publication. We will coordinate the timing and scope of disclosure with you, credit you if requested, and use a public advisory or CVE when appropriate.

Report data

Send only the evidence needed for triage. We restrict access to reports and may share relevant details with service providers or affected vendors when required to investigate and remediate the issue.

Ready to report?

Email the security contact with the affected asset and your reproduction steps.