Responsible disclosure

Help us protect the trust ledger and the people who rely on it.

Report privately

Contact support@maib.io with affected endpoint/version, expected behavior, actual behavior and a minimal reproduction. Use accounts and artifacts you control. Never access another tenant's evidence or perform destructive tests.

Keep the impact bounded

Stop when you have enough evidence. Do not exfiltrate data, disrupt availability, send unsolicited alerts or publish exploitable details before coordination. We aim to acknowledge reports promptly; no response-time SLA or bounty is promised.

Scope

The DriftSeal hosted service and official scanner distributions are in scope. Third-party packages scanned by DriftSeal and neighbouring mAIb services are not automatically in scope for testing through this policy.