Security
Vulnerability Disclosure Policy
At Hector, we take the security of our platform and our customers’ data seriously. If you believe you have discovered a vulnerability in Hector, including in its AI features, we want to hear about it. This policy explains how to report it to us and what you can expect from us.
How to report a vulnerability
Email us with "Security" in the subject line. Reports are welcome in English or French.
[email protected]Please include:
- A description of the vulnerability and the affected URL or feature
- Step-by-step instructions to reproduce it
- The impact you observed, with screenshots or a proof of concept if available
- How we can contact you for follow-up questions
Scope
This policy covers
- The Hector web application and its API
- The Hector agents (Pheidix and Odysseus)
- Gaia, the AI features built into Hector
Out of scope
- Denial-of-service attacks
- Social engineering or phishing of our staff or customers
- Physical attacks
- Vulnerabilities in third-party services we integrate with (please report those to the vendor)
- Reports of missing best practices without a demonstrated security impact
AI-specific vulnerabilities
We specifically welcome reports about Gaia, including:
Prompt injection
Content that causes Gaia to ignore its instructions or behave in unintended ways.
Unsafe or misleading output
AI results that could cause harm or that Hector presents without the appropriate safeguards.
Data leakage
Any way to obtain another customer's data, our prompts, or credentials through AI requests or responses.
Abuse of AI features
Bypassing AI credit limits or using AI features without authorization.
Weaknesses in the underlying AI models themselves, such as a general jailbreak of a model, should also be reported to the model provider. We still want to hear about them if they affect Hector.
Testing guidelines
- Only test against accounts and data that you own or are authorized to use.
- Do not access, modify or delete data belonging to others. If you encounter such data, stop and report it to us.
- Do not run denial-of-service or high-volume automated scans. Our systems may block this traffic automatically.
- Give us reasonable time to fix the issue before disclosing it publicly.
What you can expect
- We will acknowledge your report within 3 business days.
- We will provide an initial assessment, including severity, within 10 business days.
- We will keep you informed of our progress until the issue is resolved.
- With your permission, we will credit you for your discovery.
Our remediation targets
Measured from the time we confirm a vulnerability.
Safe harbor
If you make a good-faith effort to follow this policy, we will consider your research authorized, we will not pursue legal action against you, and we will work with you to understand and resolve the issue quickly.
We do not currently offer monetary rewards for vulnerability reports.
Found a vulnerability?
Email [email protected] with "Security" in the subject line.