---
title: "Vulnerability disclosure policy"
canonical: https://pentestllm.ai/security
generated: 2026-11-11T18:02:53.133Z
source: https://pentestllm.ai/security
base_url: https://api.pentestllm.ai/v1
---

![Rows of server cabinets in a data centre](https://pentestllm.ai/img/datacenter.webp)

Last updated 2026-11-11

If you find a security problem in PentestLLM itself, write to [security@pentestllm.ai](mailto:security@pentestllm.ai). No account is needed. Include the steps to reproduce it, the host and path, the time in UTC, and the request id from the `x-uplink-request-id` response header if the API was involved.

Please do not post the details in public before we have had a reasonable time to fix it. The machine-readable copy of this contact is at [/.well-known/security.txt](https://pentestllm.ai/.well-known/security.txt).

- This site, `pentestllm.ai`.
- The console, `app.pentestllm.ai`.
- The API, `api.pentestllm.ai`.

- The hosts that run the models, the payment processor’s pages and any other third-party service. Report those to their owners.
- Denial of service, volume or load testing, and spam.
- Social engineering of staff, and physical attacks.
- What a model says. A model that answers or declines a prompt is not a vulnerability in the service; misuse of the models is covered by the [acceptable use policy](https://pentestllm.ai/acceptable-use).
- Reports from automated scanners with no demonstrated impact, such as a missing header on its own.

- Test only with accounts and keys that are yours.
- Do not read, change or delete data that belongs to someone else. If you reach such data, stop and tell us.
- Use the least access needed to show the problem, and do not keep data after the report.
- Do not degrade the service for others.

- Reports to the address above go to the people who run the gateway.
- Uplink Switch LLC will not pursue legal action over research that follows this policy and is done in good faith.
- We will tell you when a reported problem is fixed, and credit you if you want that.
- There is no paid bug bounty program at this time.

If the service was used against you or your systems, that is an abuse report, not a vulnerability: write to [abuse@pentestllm.ai](mailto:abuse@pentestllm.ai), no account needed.