SECURITY / RESPONSIBLE DISCLOSURE

Help us protect agent access.

Use this private channel for suspected vulnerabilities in the Working Machines website, hosted runtime, MCP authorization flow, or account surfaces. General product support belongs on the Contact page.

Safe testing boundaries

Test only accounts, workspaces, connections, and data you own or have explicit permission to assess.
Stop if testing could expose unrelated personal data, provider credentials, or another customer's workspace.
Do not perform denial of service, destructive writes, social engineering, spam, or persistence.
Use the smallest proof needed to explain the issue; redact tokens, secrets, and customer payloads.
Allow a reasonable remediation period before public disclosure and coordinate when user safety may be affected.

A useful report includes

Affected URL or endpoint, prerequisite account state, expected versus observed behavior, impact, safe reproduction steps, approximate time, and a way to contact you. We do not promise a bounty, response deadline, or safe-harbor term beyond what is stated on this page.

Report a vulnerability