Skip to content

Security and disclosure

Acceptable use / Terms / Privacy

Rows of server cabinets in a data centre

Last updated 2026-11-11

If you find a security problem in PentestLLM itself, write to security@pentestllm.ai. No account is needed. Include the steps to reproduce it, the host and path, the time in UTC, and the request id from the x-uplink-request-id response header if the API was involved.

Please do not post the details in public before we have had a reasonable time to fix it. The machine-readable copy of this contact is at /.well-known/security.txt.

  • This site, pentestllm.ai.
  • The console, app.pentestllm.ai.
  • The API, api.pentestllm.ai.

  • The hosts that run the models, the payment processor’s pages and any other third-party service. Report those to their owners.
  • Denial of service, volume or load testing, and spam.
  • Social engineering of staff, and physical attacks.
  • What a model says. A model that answers or declines a prompt is not a vulnerability in the service; misuse of the models is covered by the acceptable use policy.
  • Reports from automated scanners with no demonstrated impact, such as a missing header on its own.

  • Test only with accounts and keys that are yours.
  • Do not read, change or delete data that belongs to someone else. If you reach such data, stop and tell us.
  • Use the least access needed to show the problem, and do not keep data after the report.
  • Do not degrade the service for others.

  • Reports to the address above go to the people who run the gateway.
  • Uplink Switch LLC will not pursue legal action over research that follows this policy and is done in good faith.
  • We will tell you when a reported problem is fixed, and credit you if you want that.
  • There is no paid bug bounty program at this time.

If the service was used against you or your systems, that is an abuse report, not a vulnerability: write to abuse@pentestllm.ai, no account needed.