Vulnerability Disclosure Policy

How to report

A description of the vulnerability and its potential impact
The affected asset (URL, API endpoint, or product)
Step-by-step reproduction instructions, including any proof-of-concept code or requests
Your name or handle, if you'd like to be acknowledged

Please do not send reports to our general support address, and please don't include anyone else's data in your report.

What to expect

Every report is reviewed by our security team. Our response targets are:

Acknowledge your report within 5 business days
Assess its validity and severity within 15 business days of acknowledgment
Keep you informed of our progress and let you know when the issue is resolved

Remediation timelines depend on the severity and complexity of the issue. Please give us a reasonable amount of time to fix it before any public disclosure, and coordinate the timing with us. We're happy to discuss disclosure plans once a fix is in place.

We won't share your name or contact info without your permission, unless the law requires it.

Scope

In scope

goodfire.ai and goodfire.com, and their subdomains owned and operated by Goodfire
Goodfire products and services made available to customers or the public, including web applications, APIs, and downloadable software, as they are released

Out of scope

Third-party services and platforms we use (e.g., hosting providers, SaaS tools, payment processors). Please report those issues to the vendor directly.
Client-deployed or customer-hosted instances of our software, unless the vulnerability is in Goodfire's own code
Staging, test, or development environments not listed above

Qualifying vulnerabilities

We're most interested in issues with real security impact, such as:

Authentication or authorization bypass
Access to another user's or customer's data, models, or workloads
Cross-tenant data exposure
Remote code execution or server-side request forgery (SSRF)
SQL or command injection
Stored or reflected XSS with demonstrated impact on authenticated users
Exposure of credentials, secrets, or sensitive internal data

Non-qualifying issues

The following are not eligible under this policy unless the report demonstrates a concrete, exploitable security impact:

Missing or misconfigured SPF, DKIM, or DMARC records
Missing HTTP security headers (CSP, HSTS, X-Frame-Options, etc.)
Clickjacking on pages without sensitive actions
Self-XSS or issues requiring the victim to paste code into their own browser
Missing rate limiting on non-sensitive endpoints
Software version or banner disclosure
TLS/SSL configuration findings (cipher suites, protocol versions)
Open redirects without additional impact
CSRF on logout or other non-state-changing actions
Username or email enumeration
Results from automated scanners submitted without validation
Denial of service or volumetric attacks
AI model behavior on its own, including jailbreaks, prompt injection, or undesired model outputs, unless it leads to a security impact such as data exposure, cross-tenant access, or access to infrastructure

Rules of engagement

When testing, please:

Test only to find security issues and report them to us, and follow all applicable laws
Only test against accounts you own or have explicit permission to use
Stop testing and report immediately once you've confirmed a vulnerability
Access only what you need to show the issue, and show it using your own accounts and data. Don't copy, download, or keep our source code, models, or anyone else's data. If you run into data that isn't yours, stop, tell us where and how you found it (not what it says), and delete any copies.
Not degrade our services or disrupt other users (no DoS, spam, or heavy automated scanning)
Not attempt to pivot to other systems after gaining access
Not phish, social-engineer, or physically test our staff, contractors, or offices
Not publicly disclose the issue before we've had a reasonable chance to fix it
Not make disclosure conditional on payment or any other demand

If you use automated tools or AI agents, they must follow these rules too. You're responsible for what they do.

Safe harbor

If, in Goodfire's sole determination, you make a good faith effort to research and disclose vulnerabilities in accordance with this policy, we will consider your research authorized. For such research, and subject to Goodfire's compliance with applicable laws and legal obligations, we:

Waive any restrictions in our Terms of Use or other terms that govern our services that would conflict with this policy, for the limited purpose of that research
Will not bring legal action against you, including for circumventing technical measures that protect the in-scope systems
Will not pursue accidental, good-faith violations of this policy
Will make it known that your research was authorized under this policy if a third party brings legal action against you

To qualify for safe harbor, disclosures must be unconditional and may not involve extortion or threats. Activity that doesn't follow this policy, or isn't in good faith, isn't authorized, and we keep all our rights and remedies for it. Testing under this policy doesn't stop us from rate-limiting, blocking, or suspending accounts to protect our systems.

This safe harbor covers only Goodfire's systems. We can't authorize testing of third-party services, and third parties are not bound by this policy.

If you're unsure whether your planned testing is consistent with this policy, please contact us at security@goodfire.ai before proceeding.

Rewards

Goodfire does not currently offer a paid bug bounty program, and submitting a report does not create an obligation of payment. We may introduce a rewards program in the future, and we reserve the right to recognize especially valuable reports at our discretion. In the meantime, we're glad to publicly thank researchers who report valid, in-scope issues.

Changes to this policy

We may update this policy. Reports are handled under the version in place when they were sent.