> ## Documentation Index
> Fetch the complete documentation index at: https://api.agentflow-enterprise.com/llms.txt
> Use this file to discover all available pages before exploring further.

# How to Report Security Concerns to the AgentFlow Team

> Find out how to responsibly report security concerns to the AgentFlow team, what to include in a report, and what is in and out of scope.

If you discover a security concern related to AgentFlow's public documentation, this repository, or its published materials, report it directly and privately to the AgentFlow team. Responsible disclosure protects everyone — it lets the team address real issues quickly without creating additional exposure through public channels. This page explains exactly how to report, what to include, and what falls inside and outside the scope of this process.

## How to Report

<Note>
  Send all security concerns to **[contact@agentflow-enterprise.com](mailto:contact@agentflow-enterprise.com)**. This is the only supported reporting channel. Do not open a GitHub issue for security-related findings.
</Note>

When you reach out, the team will acknowledge your report and triage it promptly. You do not need to follow a complex process — a clear, direct email with the details below is sufficient.

## What to Include in Your Report

To help the team understand and address your concern quickly, include the following in your message:

1. **A clear summary** of the security concern — describe what you found and why it matters
2. **The affected page or file** — link to or name the specific public file, page, or URL involved
3. **Reproduction steps** — if the issue can be demonstrated, explain how to reproduce it
4. **Recommended remediation** — if you have a suggested fix or mitigation, include it

You do not need to include private source code, internal configuration details, or proprietary information in your report.

## Scope

Not every security question falls within the scope of this public disclosure process. Use the table below to determine whether your concern is in scope before reaching out.

| In Scope                                                          | Out of Scope                                                                  |
| ----------------------------------------------------------------- | ----------------------------------------------------------------------------- |
| Accidental exposure of sensitive information in public files      | Requests for private source code or internal implementation details           |
| Misleading or inaccurate security statements in documentation     | Attempts to bypass access controls or authentication                          |
| Unsafe public documentation that could mislead security reviewers | Attacks against third-party services (Supabase, Stripe, OpenAI, Vercel, etc.) |
| Broken links that could misdirect security-focused buyers         | Social engineering attempts targeting AgentFlow team members                  |
| Documentation that exposes internal details unintentionally       | Speculative reports without practical, demonstrable impact                    |

If your concern falls outside this scope, it is still fine to reach out through the general contact address — but be aware it may not be prioritized through the security triage process.

## Do Not Post Publicly

<Warning>
  Do not post sensitive vulnerability details, reproduction steps, or findings related to credentials, access controls, or internal implementation in public GitHub issues, social media, or community forums. Public disclosure before the team has had a chance to respond and remediate creates unnecessary risk. If you are unsure whether something is sensitive, err on the side of private disclosure.
</Warning>

This applies even if the issue seems minor. The team will work with you to determine the right response and, where appropriate, acknowledge your contribution.

## Response Expectations

After you send a report to [contact@agentflow-enterprise.com](mailto:contact@agentflow-enterprise.com), you can expect:

* **Acknowledgement** — the team will confirm receipt and that your report is being reviewed
* **Triage** — the team will assess the severity and scope of the concern
* **Follow-up** — if more information is needed, the team will reach out directly

Response times are not guaranteed by SLA, but the team is committed to taking responsible disclosure seriously and responding promptly.

## Bug Bounty

There is no public bug bounty program currently. The team appreciates responsible disclosure and will acknowledge valid contributions, but no financial reward is offered at this time.

***

**Related:** [Security Overview](/security/overview) · [Data Handling](/security/data-handling)