Responsible Disclosure Policy

Reporting a vulnerability

Wentzel.ai welcomes coordinated disclosure of security vulnerabilities. We do not run a paid bug-bounty programme; we do credit researchers in our security advisories where requested.

The fastest way to reach the security team is the Security Incident request type in the customer portal. The portal supports attachments and is encrypted in transit (TLS).

Email is acceptable for reporters who prefer it: security@wentzel.ai. Subject line SECURITY-DISCLOSURE goes directly to on-call.

Scope

• Every Wentzel.ai-owned domain: wentzel.ai and its subdomains, plus per-product hosts (cytra.io, q.wentzel.ai, mapshub.ai, lawvora.us, oculirx.com, etc.).
• Every Wentzel-published package on GitHub Packages and npm.
• The support.wentzel.ai intake surface itself.

Out of scope

• Denial-of-service or volumetric attacks. Please do not test these.
• Findings that require physical access to a Wentzel.ai employee's device.
• Social-engineering attacks against Wentzel.ai staff.
• Vulnerabilities in third-party SaaS we use (route those to the upstream vendor; we are happy to coordinate).

What to expect

• Acknowledgement within one business day.
• Triage and severity assessment within five business days.
• Remediation timeline that matches severity — Critical findings are patched within 72 hours; High within 14 days; Medium and below within the next regular release.
• Public credit (with your permission) once the patch ships.

Safe harbour

Researchers who follow this policy in good faith — staying in scope, not exfiltrating data beyond what proves the finding, and giving us a reasonable disclosure window — will not face legal action from Wentzel.ai for their research.

Machine-readable details

The canonical security.txt for Wentzel.ai lives at /.well-known/security.txt.