Legal Security and disclosure

Security and responsible disclosure

Last updated 1 November 2026

If you believe you have found a security vulnerability in CADMCP.AI, please tell us privately. We are grateful for reports, and we will work with you to fix the problem.

How to report

Email info@cadmcp.ai with “Security” at the start of the subject. Please include:

what you found and where (the address, the component, or the agent version);
the steps to reproduce it, and what an attacker could do with it;
how to reach you, and whether you would like to be credited.

Please do not include other people’s personal data in your report.

In scope

cadmcp.ai and its subdomains, including the online service at mcp.cadmcp.ai once it is live.
The CADMCP.AI Agent and any add-in installed with it.
Ways around the approval card, the pause switch, request signing or account isolation.

Out of scope

Denial-of-service tests, spam, social engineering and physical attacks.
Problems in third-party services such as Stripe, or in WordPress and its plugins in general; please report those to their makers.
Reports from automated scanners without a demonstrated impact.

Please

Test only with accounts and computers you own, and never access, change or delete other people’s data.
Stop and tell us as soon as you find a problem; do not keep exploring.
Give us reasonable time to fix it before you tell anyone else.

Our promise

We will acknowledge your report within [placeholder: number of business days].
We will keep you informed while we fix it, and credit you if you wish.
If you act in good faith and follow this policy, we will not take legal action against you for your research. [placeholder: confirm safe-harbour wording with a lawyer]

We do not run a paid bug bounty at the moment.

More about how CADMCP.AI is designed: Security and trust.