---
title: "Responsible Disclosure | Gazebo Docs"
description: "How to report a security vulnerability to Gazebo — our disclosure process and response commitments."
url: "https://gazebohq.com/docs/security/disclosure"
---

If you discover a security vulnerability in Gazebo, please report it responsibly. We take all reports seriously and will respond promptly.

## How to report

**Email:** security@gazebohq.com

Please include:

- A description of the vulnerability
- Steps to reproduce
- The potential impact (what an attacker could do)
- Any proof-of-concept code or screenshots (if applicable)

We ask that you do not publicly disclose the vulnerability until we've had a chance to investigate and release a fix.

## What to expect

- **Acknowledgement** within 24 hours of your report
- **Initial assessment** within 72 hours — we'll confirm whether the report is valid and its severity
- **Fix timeline** communicated once the severity is assessed — critical issues are addressed immediately; lower severity issues are scheduled in the next release cycle
- **Credit** — we'll acknowledge your contribution in the fix notes if you'd like

## Scope

**In scope:**
- Authentication and authorization bypasses
- Credential leakage — any path that returns a plaintext credential to an unauthorized party
- Privilege escalation — accessing another user's vault, agents, or audit logs
- MCP or REST API vulnerabilities
- Injection vulnerabilities in any user-controlled input

**Out of scope:**
- Rate limiting or denial of service
- Theoretical vulnerabilities without demonstrated impact
- Issues requiring physical access to infrastructure
- Social engineering attacks

## Bug bounty

We do not currently operate a formal bug bounty program, but we recognize significant contributions with acknowledgement and Gazebo credits.