Skip to content

Reporting a security problem

If you find a security problem on automationatlas.io, including Atlas Labs, please email cybersecurity@shadow-gen.com. Research in good faith within the scope below is welcome, and we will not take legal action over it.

Report to: cybersecurity@shadow-gen.com. The machine-readable version of this policy is at /.well-known/security.txt.

In scope

  • automationatlas.io, including Atlas Labs under /labs/.
  • For Atlas Labs, test only against sandboxes you created yourself. Everything in a sandbox is fictional test data.

Out of scope

  • Denial of service and load testing.
  • Social engineering of our people or anyone else.
  • Physical attacks.
  • Third-party services we use, such as Cloudflare and Formspree. Report those to their own owners.

Safe harbour

If you act in good faith and stay within the scope above, we will not pursue legal action against you, and we will work with you to understand and fix what you found.

How to report

Email cybersecurity@shadow-gen.com with the steps to reproduce the problem, the request and the response, and what you think the impact is. Remove any API keys before you send anything; they are never needed.

What to expect

  • We acknowledge your report within three business days.
  • There is no bug bounty. We are happy to credit you by name once the problem is fixed, if you ask us to.

Not a security problem? Feedback, bug reports and ideas go through the contact form.