How to report
Send a private report to security@chrysent.ai with a clear subject line. You can also use the form at /contact/security, which routes to the same channel.
Encrypted reports are welcome. Encrypt your message to security@chrysent.ai with the key published in the next section, and quote its fingerprint in your message so we can confirm which key you used.
Encrypted channel
This is the only key we use to receive vulnerability reports. If a message arrives encrypted with a different key, or without this fingerprint, we may not be able to read it.
Verify the fingerprint before you encrypt: gpg --show-keys /pgp/chrysent-security.asc. To import the key, use gpg --import /pgp/chrysent-security.asc, then encrypt to security@chrysent.ai.
-----BEGIN PGP PUBLIC KEY BLOCK----- mDMEat2rkhYJKwYBBAHaRw8BAQdA5nat5NKYhtezVlLblcLDRNRejJ1tlytJF6L9 1Qz+QrW0SkNocnlzZW50IFNlY3VyaXR5IFRlYW0gKEZvciByZXNwb25zaWJsZSBk aXNjbG9zdXJlKSA8c2VjdXJpdHlAY2hyeXNlbnQuYWk+iLUEExYKAF0WIQTw9eFA 2iM4c+B1PYC514o7S/nB9AUCat2rkhsUgAAAAAAEAA5tYW51MiwyLjUrMS4xMiww LDMCGwMFCQlmAYAFCwkIBwICIgIGFQoJCAsCBBYCAwECHgcCF4AACgkQudeKO0v5 wfRq+wEAvdpLruLJcnxNVyKZmiqjnJ4wMTUEc0eK60vULwo7whQBAOnYknYY2Sud 9Lil+HI2ZGnuwq1ozmQlXId7RXEEIMULuDgEat2rkhIKKwYBBAGXVQEFAQEHQDw+ +F9iBbD00TUUVhDQaY3lsQwthZyO4nQUqg6AM1tpAwEIB4iaBBgWCgBCFiEE8PXh QNojOHPgdT2AudeKO0v5wfQFAmrdq5IbFIAAAAAABAAObWFudTIsMi41KzEuMTIs MCwzAhsMBQkJZgGAAAoJELnXijtL+cH0MYABAOkcrBXSxwtY6FJUZd4jnrBH9V2X Kz8lMtxk36CCe9FwAQCBCzqQazqs7Z2O6Eo0Y1ny5yUsI79V727+z0Nr3pPECA== =KC3v -----END PGP PUBLIC KEY BLOCK-----
Download the public key · /pgp/chrysent-security.asc · security.txt
What to include
- Affected product (Gateway, Touchstone, Bastion, Axis Code, Axis Knowledge Base, Deep Research, OPI Forge, Chrysent Sandbox, or corporate)
- Affected version or commit, if known
- Environment and reproduction steps
- Observed vs. expected behavior
- Your estimate of severity and impact
- Whether the issue is being disclosed elsewhere or under coordinated disclosure
Our commitment
- Acknowledge within two business days.
- Provide a triage assessment within five business days.
- Coordinate disclosure timing with you, including the option to publish jointly.
- Notify you when a fix ships, with credit unless you ask otherwise.
Scope
In scope
- Chrysent Gateway, Touchstone, and Bastion private-beta deployments.
- Chrysent-hosted services reachable at
*.chrysent.ai. - Documentation inaccuracies that lead to insecure configurations.
Out of scope
- Social engineering of Chrysent employees, contractors, or design partners.
- Denial-of-service testing.
- Physical intrusion testing.
- Third-party services we rely on (please report to the upstream vendor).
Legal posture
We will not pursue legal action against researchers who follow this policy in good faith. We ask that you avoid privacy violations, do not destroy data, and give us a reasonable window to investigate before any public disclosure.
Coverage and its limits
Every record Chrysent keeps states exactly what was observed and what was stored, so a reviewer can tell metadata-only evidence from retained content.
No record is not the same as no event. When something happens outside a system Chrysent governs — a direct call to a model provider, a tool running on your own infrastructure, or a third-party service — Chrysent never sees it and cannot report it. We describe what we observed and claim nothing beyond it.
Testing outside the published scope is still welcome. Those reports tell us where coverage should extend next.