Security
Responsible disclosure policy
Think you have found a vulnerability in an ELYSÉA service? Write to us before any publication: we will fix it and keep you informed.
Scope
- The elysea.app site and its /api routes;
- the brain API consumed by the SDK (routes described in the OpenAPI specification);
- the SDK packages published by ELYSÉA.
How to report
- Write to contact@elysea.app, subject “[SECURITY]”;
- describe the vulnerability, the steps to reproduce it, the observed impact, and your contact details;
- do not send any third party’s personal data.
What we ask of you
- Test only with your own accounts and test keys (sk_test_);
- do not access other people’s data beyond what is strictly needed to show the problem, and do not keep it;
- no denial of service, no social engineering, no physical testing;
- give us time to fix before any publication.
What we do
- We acknowledge your report and keep you informed of its handling;
- we do not publish any committed timeframe today;
- legal commitments to researchers (safe harbour) are being drafted and are not published yet.