Vulnerability disclosure policy.

Email security@mgmt-os.ai with a description of the issue, the steps to reproduce it, and any proof-of-concept detail that helps us confirm it. If the report is sensitive, ask us for a secure channel and we will arrange one. Our machine-readable contact is published at /.well-known/security.txt.

• We acknowledge every report we receive, typically within two business days.
• We investigate promptly, keep you updated on our assessment, and let you know when the issue is resolved.
• We'll credit you for the discovery if you'd like, once the issue is fixed.

• Give us a reasonable window to investigate and remediate before any public disclosure.
• Make a good-faith effort to avoid privacy violations, data destruction, and any interruption to the Service.
• Only interact with accounts you own or have explicit permission to test — do not access, modify, or exfiltrate other customers' data.
• Do not run automated scanning that degrades the Service, and do not use social engineering, physical attacks, or denial-of-service techniques.

We will not pursue or support legal action against researchers who act in good faith and in accordance with this policy. If a third party brings action against you for activity conducted under this policy, we will make it known that your actions were authorized. If you are unsure whether a specific action is acceptable, ask us first at security@mgmt-os.ai.

In scope: the Management OS application and its APIs at mgmt-os.ai and its subdomains. Out of scope: our third-party sub-processors' own infrastructure (report those to the provider directly), findings that require a compromised device or account, and best-practice suggestions without a demonstrable security impact. Our sub-processors are listed at mgmt-os.ai/subprocessors.

We are a small, bootstrapped team and do not yet run a paid bug bounty. We take every report seriously, remediate quickly, and offer public acknowledgment. As the company grows, we intend to formalize a rewards program — and we'll say so here when we do, rather than imply one that doesn't exist.