Responsible Security Disclosure

1. Our commitment

We invite security researchers to share their findings with us responsibly. We commit not to pursue legal action against researchers who act in good faith and follow the rules below (safe harbor), and we aim to respond to your reports within a reasonable time.

2. Scope

In scope: semagent.ai and its subdomains, the embedded widget, and public API endpoints.

Out of scope: denial of service (DoS/DDoS), social engineering or phishing, physical attacks, vulnerabilities in third-party services (e.g. our hosting provider), and automated scanner output without demonstrated impact.

3. Research rules

• Do not damage or delete data or violate privacy; use only your own test account.
• Use a vulnerability only to the minimum extent needed to confirm it; do not copy or retain any data you access.
• Do not disclose a vulnerability publicly before giving us a reasonable time to remediate (e.g. 90 days) after reporting it.
• Stay within the limits of applicable law.

4. How to report

Send your findings to [email protected]. Please include: the type and impact of the vulnerability, reproduction steps, a proof of concept (PoC) if available, and the affected endpoint/parameter. Reports in English or Turkish are welcome.

5. Process

• Acknowledgement: we usually acknowledge your report within 5 business days.
• Triage and fix: we prioritize by severity and keep you updated on progress.
• Recognition: we do not currently run a formal bug bounty program, but we are sincerely grateful for your contribution and will credit you with your permission.

6. Legal

Good-faith security research conducted in line with this policy is considered "authorized," and we will not pursue legal action against you. Failure to follow the rules removes this protection.

Last updated: 8 July 2026