We take the security of Adrian seriously, and we welcome security research. Adrian exists to make AI agents safer, so we would rather hear about a genuine problem than not. This document explains how to report one and what to expect in return.

Please report suspected vulnerabilities privately, through the contact form:

https://www.secureagentics.ai/contact

Do not open a public GitHub issue, pull request, or Discord message for a suspected vulnerability, and please do not publish findings before we have had a chance to respond. Public issues are for bugs and feature requests, not security reports. Coordinated disclosure gives current Adrian users time to update before details are public, which is the outcome that actually protects them.

We are a small team and will respond as promptly as we can. The following are targets to give you a sense of timing, not contractual commitments:

• We aim to acknowledge a report within about 3 business days.
• We aim to confirm whether we can reproduce the issue, with an initial assessment, within about 10 business days.
• We work to a coordinated disclosure window of up to 90 days from acknowledgement, and we are happy to agree a specific publication date with you. If a fix ships sooner, we will coordinate publication sooner.
• We do not currently run a paid bug bounty. With your permission, we are glad to credit you in the advisory or release notes when we publish.

Adrian is a configurable, model-backed system, so the same action can be correct in one deployment and a violation in another. A report we can act on and reproduce includes:

• Clear reproduction steps, and the exact version or commit tested.
• The deployment tier: self-hosted (including the classifier model and its size) or the managed service.
• The full configuration relevant to the finding, including the agent remit profile, the execution mode, and policy settings such as fail_closed_on_classifier_error.
• The raw traces, verdicts, or session identifiers that show the behaviour, plus any attack harness or seeds needed to reproduce it.

For findings about detection or classification behaviour specifically, include the agent remit profile and policy settings: Adrian judges behaviour relative to the declared remit and handles errors according to operator policy, so a classification finding without that configuration cannot be interpreted or reproduced. Findings that do not depend on classification (for example authentication, access control, or injection in the backend or SDKs) do not need a remit profile.

In scope:

• The Adrian backend, SDKs, and official integrations in this repository.
• The managed service at app.adrian.secureagentics.ai and its API.

Out of scope:

• Findings that rely on an intentionally vulnerable test harness (for example, an unsandboxed code-execution tool, or a tool with no access controls) rather than a realistic deployment.
• Claims about "Adrian" or the managed tier that are demonstrated only on the smallest self-hosted classifier, without validating against the tier being described.
• Denial of service through resource exhaustion, and volumetric or load testing against the managed service.
• Reports generated by automated tooling without a reproducible test case.

We welcome and are glad to collaborate with researchers who act in good faith, follow this policy, and give us reasonable time to respond before disclosure.

Testing must not harm Adrian's users or the service. The following are forbidden:

• Denial of service, resource exhaustion, or any action that degrades or affects the availability of the service.
• Accessing, modifying, deleting, or storing data belonging to any other user, or any other action affecting the confidentiality or integrity of other users' data.
• Testing against any account other than your own on the managed service.

If you are unsure whether something is in scope or permitted, ask us first through the contact form.