Security and Vulnerability Reporting

Current implementation

• The website is hosted through OpenAI Sites on Cloudflare infrastructure.
• Contact, early-access, and privacy submissions are written server-side to a non-public Cloudflare D1 database.
• No public endpoint lists or retrieves submissions.
• The site has no payment flow, public user accounts, uploads, customer API keys, repository connections, agent execution environment, or connected business systems.
• No third-party analytics, advertising scripts, or external embeds have been added.

These facts are an implementation description, not a certification, penetration-test result, encryption guarantee, data-residency commitment, or service-level promise.

Responsible reporting

Use the contact form and begin the message with “Security report.” Include the affected URL, a concise description, reproduction steps that avoid accessing other people’s data, and your preferred contact details. Do not include exploit payloads containing personal information or secrets.

Research boundaries

• Test only this Arcwise AI site and only in ways authorized by law.
• Do not perform denial-of-service testing, automated destructive scanning, social engineering, credential attacks, or attempts to access submissions belonging to others.
• Stop and report if you encounter personal information, credentials, or evidence of active compromise.
• Give us a reasonable opportunity to investigate before public disclosure.

We do not promise a bounty, safe-harbor agreement, response time, or remediation deadline. A separate written authorization is required for any test beyond ordinary good-faith verification.

Future product controls

If the proposed service launches, its security model will need to address API credentials, customer place queries, source licensing, environment separation, access logs, exports, retention, connected systems, and human approval for agent actions. Those controls are not described as operational until they are implemented and verified.