1.How to report
Email security@scaledthought.com with a description of the issue, the steps to reproduce it, the affected host or component, and its impact as you understand it. Please don't include other people's data, secrets or API keys you have found; describe where they are instead.
We aim to acknowledge reports within 3 business days and to keep you updated until the issue is resolved.
2.Scope
- The us API, MCP server and payment approval pages at
api.us.scaledthought.com. - The ca API, MCP server and payment approval pages at
api.ca.scaledthought.com. - This website, scaledthought.com, including /llms.txt.
- The
scaledthoughtCLI published on npm.
3.Rules of engagement
- Test only against accounts you created yourself. Never access, change or delete other customers' data.
- Stop and report as soon as you can show the issue; don't go further than needed to prove it.
- No denial-of-service, load or volume testing, spam, social engineering, or physical attacks, and no testing of our staff console.
- Don't test our providers (for example Stripe, AWS or our inference providers); report issues in their services to them.
- Respect rate limits and the signup limits, and don't create large numbers of accounts.
- Keep the details confidential until we have fixed the issue and agreed a disclosure date with you.
4.Our commitments
If you follow this policy in good faith, we will not pursue or support legal action against you for your research, and we will consider your research authorised under our Terms of Service and Acceptable Use Policy. We will credit you publicly if you want us to.