ROGUE-AGENT DEFENSE INTERCEPTOR

Vulnerability Disclosure Policy

Last updated: October 14, 2026.

Rogue-Agent Defense (https://rogue-defense.getingeniousai.com) is operated by Ingenious AI. We are a security company — inviting and acting on reports is how we stay ahead. If you find a vulnerability in our service, we want to hear about it, and we will treat your report seriously.

How to report

Email [email protected] with "SECURITY:" in the subject line. Include:

  • A description of the issue and the affected URL or endpoint.
  • Steps to reproduce, including anything you used (curl commands, request/response pairs).
  • The impact as you see it — what an attacker could do with this.
  • Your name or handle and how we can reach you, so we can confirm the fix.

Please do not attach exploit payloads designed to persist or spread; a proof-of-concept that demonstrates the issue is enough.

What we promise

  • Acknowledgment within 3 business days. We confirm every valid report by email.
  • Assessment within 14 days. We tell you how we rate the issue and what we plan to do.
  • Fix before disclosure. We ask that you give us reasonable time to fix the issue before any public disclosure, and we will keep you updated on progress.
  • Credit if you want it. We are happy to credit good-faith researchers by name or handle in our changelog — or keep you anonymous, your choice.

Safe harbor

We will not take legal action against anyone who reports a vulnerability in good faith under this policy, provided you:

  • Report it to us promptly and do not disclose it publicly before we have had a reasonable chance to fix it.
  • Do not access, modify, or delete other users' data, and do not degrade the service for others.
  • Do not use the vulnerability for any purpose other than demonstrating it to us (no fraud, no extortion, no data theft).

Scope

In scope: the Rogue-Agent Defense web application and API at https://rogue-defense.getingeniousai.com, including authentication, billing/licensing flows, the prompt-injection shield, the policy proxy and approval queue, canary-token and kill-switch systems, and agent API endpoints.

Out of scope

  • Denial-of-service testing or anything that degrades the service for other users.
  • Spam, phishing, or social-engineering of our users or team.
  • Physical attacks, or attacks on third-party services we depend on (hosting, payment, email providers) — report those to the relevant provider.
  • Reports about missing best-practice headers or theoretical issues with no demonstrated impact.

Our own defenses

We run automated abuse detection on every platform, including honeypot endpoints that log and block scanner traffic. If your good-faith testing trips an automated block, tell us in your report and we will lift it immediately — an accidental block will never count against a legitimate disclosure.

How we protect the service itself

What Rogue-Agent Defense actually does today — each item is implemented in the running service, not a roadmap:

  • Passwords are never stored in plain text. They are hashed with PBKDF2-SHA256 at 600,000 rounds.
  • Secrets at rest are hashes. API keys, password-reset tokens and email-change tokens are stored only as SHA-256 digests; the raw value exists only in the link or key shown once.
  • License keys are signed. Every Pro/Team key carries an HMAC-SHA256 signature and is verified in constant time before a workspace unlocks.
  • Sessions can be killed everywhere at once. A server-side session version is checked on every request; password changes, password resets, email changes and logout all bump it, invalidating every earlier session. Sessions also expire after 30 minutes idle.
  • Rate limiting and lockout. Login, signup, password reset, email change and the public Live Intercept check are rate-limited per IP and per account (10 failed logins in 15 minutes locks the account).
  • Tamper-evident records where it counts. The Agent Reach Map keeps a hash-chained, append-only delta audit rail, and the in-product audit log records security-relevant admin actions.
  • Honest scope: Rogue-Agent Defense is operated by Ingenious AI, a small independent company. We do not hold SOC 2 or ISO 27001 certification, we do not offer SAML SSO or SCIM provisioning, and we do not publish a DPA or subprocessor list — if your review needs those today, this page is the accurate answer, not a sales page.

Questions about this policy? Email [email protected]. You can also find our machine-readable contact in /.well-known/security.txt (RFC 9116).