Skip to content
AI Workforce OS
ES EN
Create account

Vulnerability disclosure

If you found a security issue in AI Workforce OS, we want to know. We are a small team: there is no bug bounty and no guaranteed timelines, but every report is read, investigated and answered.

3 min read

On this page
  1. How to report
  2. What is in scope
  3. What is out of scope
  4. Safe harbor
  5. What you can expect from us
  6. What we do with each report
Back to top

How to report#

  1. E-mail info@workforceai.es with the subject "Vulnerability". It is the same contact our security.txt (RFC 9116) publishes.
  2. Describe the problem, the affected component, the steps to reproduce it and the impact you believe it has. A minimal proof of concept helps a lot.
  3. Do not include real third-party data. If you accidentally accessed data that is not yours, do not keep it and tell us in the report.
https://workforceai.es/.well-known/security.txtText
Contact: mailto:info@workforceai.es
Expires: 2027-10-13T00:00:00.000Z
Preferred-Languages: es, en
Canonical: https://workforceai.es/.well-known/security.txt
Policy: https://workforceai.es/docs/modelo-de-seguridad/

Note

We do not publish a PGP key today. If you need to send something sensitive, write to us first and we will agree on an encrypted channel. You can write in Spanish or English.

What is in scope#

We are especially interested in: data leaks between organizations, bypass of authentication, SSO, MFA or permissions, bypass of approvals, spending caps or the kill switch, exposure of credentials or secrets, abuse of signed approval links, SSRF through webhooks or web tools, and tampering with the audit chain.

  • The public site workforceai.es.
  • The application at app.workforceai.es, its API (/api/v1), the token-based public API (/api/public/v1) and the WebSocket (/ws).
  • The product's code: Go backend, Python agent runtime and frontend.

What is out of scope#

  • Third-party services: AI model providers, hosting, e-mail and the services each customer connects.
  • Denial of service, load testing and massive or noisy automated scanning.
  • Social engineering, phishing or physical access.
  • Spam and reports that only point out a missing header or best practice without demonstrable impact.

Tip

A trial account is a good place to research without touching anyone's data. Do not use it to degrade the service.

Safe harbor#

If you act in good faith and follow this policy, we will not take legal action against you or report you to the authorities for your research. Good faith means:

  • Testing only what is needed to demonstrate the issue.
  • Not accessing, modifying or deleting other people's data beyond the bare minimum.
  • Not degrading the service and not extorting.
  • Not publishing details until it is fixed, giving us a reasonable time to do so.

Note

This text is a statement of intent, not a contract, and it cannot bind third parties such as our providers. It is pending review by a lawyer.

What you can expect from us#

These are intentions, not service-level commitments. We try to acknowledge receipt within a few business days, confirm or dismiss the issue after investigating it, keep you informed and tell you when it is fixed. Fix times depend on severity and on our capacity.

We coordinate publication with you and, if you wish, credit you publicly as the reporter. We do not offer monetary rewards today.

What we do with each report#

We assess the impact, prioritize and fix it in the repository, with a regression test where possible. If the finding affected customer data, we notify the affected organizations as required by applicable law.

To see which controls exist and which do not, read the security page and the security model in the technical documentation, which includes its known limitations.

Keep reading