Reporting a security vulnerability

Scope

This policy covers Deep Reasoning AI Inc. devices and the services they depend on. If you are not sure whether something is in scope, ask us first.

How to report

Email support@deepreasoningai.com. Please include the device and version, the steps or a proof of concept to reproduce the issue, and what you believe the impact is. Screenshots or request and response captures help; please redact any personal data in them.

What we ask of you

• Test only against your own accounts, test instances, or systems you are authorized to use. Do not test against clinical deployments or devices in use with patients.
• Stop and tell us as soon as you encounter patient data, personal data, or another user's data. Do not copy, store, or share it.
• Do not run denial of service, spam, social engineering, or physical attacks.
• Give us time to fix the issue before you publish. We ask for 90 days from our acknowledgment; we will tell you if we need longer and why.
• Do not ask for payment as a condition of telling us about the issue. We do not pay for undisclosed vulnerability information.

What you can expect from us

• Acknowledgment of your report within 5 business days.
• A triage decision within 10 business days and an update at least every 30 days after that until the issue is closed.
• A single point of contact who will tell you our fix target and when we plan to publish.
• Credit in our advisory, if you want it.
• We will not threaten or pursue legal action against you for research that follows this policy.

Safe harbor

If you make a good faith effort to follow this policy, Deep Reasoning AI Inc. considers your research authorized, will not pursue or support legal action against you for it, and will work with you if a third party raises a legal question about your research. This does not authorize you to act against the law or against other organizations' systems.

Questions

Email support@deepreasoningai.com. This policy was last updated on November 3, 2026.