Responsible disclosure

A public security reporting channel is not currently published.

• this website, radcliffeai.com;
• the app, at app.radcliffeai.com;
• our API, at api.radcliffeai.com, including the MCP server that assistants connect to;
• the Radcliffe sync app for laptops.

• problems in services we use, such as Vercel, Render or Cloudflare: please report those to that service;
• reports from automated scanners with no sign of real harm;
• attacks that need someone's unlocked device, or that trick our team or customers.

• what you found, and where;
• the steps to see it again;
• what someone could do with it;
• how to reach you.

• test only with accounts you own or have permission to use;
• do not open, change, keep or share data that is not yours; if you reach someone else's data, stop and tell us;
• do not run tests that slow or stop the service, and do not send spam;
• give us time to fix the problem before you tell anyone else.

We confirm that we have your report, look into it, and keep you told as we fix it. We tell you when it is fixed.

If you follow this page in good faith, we will not take legal action against you for your research.

We do not pay rewards for reports at present.