Security & Responsible Disclosure

Found a vulnerability?

We take security seriously. If you discover a vulnerability in MeshInfer.AI, please report it responsibly via this page.

How to report

Do not open a public GitHub issue or disclose the vulnerability on social media. Instead, email us directly:

Security Email

support@dosfi.ai

Include a clear description of the vulnerability, steps to reproduce, and potential impact. We will acknowledge your report within 24 hours.

Responsible disclosure policy

Our commitment

90-day window: We commit to investigating and patching valid vulnerabilities within 90 days of your initial report.
Credit: You will be credited in our security advisory (unless you request anonymity).
No legal action: We will not pursue legal action against researchers acting in good faith within the scope of this policy.
Confidentiality: We will not disclose your report to third parties without your consent, except as required by law.

What we're looking for

Authentication bypass	Circumventing API key validation, session hijacking, or privilege escalation
Data exposure	Unauthorized access to user prompts, API keys, or billing data
Cryptographic weaknesses	Flaws in TLS, signing, encryption, or verification mechanisms
Node exploitation	Attacks that compromise peer mesh nodes or coordinator systems
Rate limiting bypass	Circumventing usage limits or quota enforcement
Denial of service	Crashes, infinite loops, or resource exhaustion attacks

What we're not looking for

Social engineering	We cannot reward phishing or pretexting attacks.
Theoretical issues	Hypothetical flaws without proof-of-concept are lower priority.
Third-party vulnerabilities	Issues in upstream dependencies (report directly to vendor).
Content policy violations	Misuse of the service (report via abuse form instead).
Brute-force enumeration	Scanning API endpoints for valid IDs without demonstrating impact.

Bug bounty program

We offer monetary rewards for valid, reported vulnerabilities. Bounty amounts depend on severity and impact:

Critical (CVSS 9–10)	$5,000–$15,000
High (CVSS 7–8.9)	$1,000–$5,000
Medium (CVSS 4–6.9)	$250–$1,000
Low (CVSS 0–3.9)	Acknowledgment

Eligibility

To be eligible for a bounty, you must: (1) be the first to report the vulnerability, (2) provide enough detail for us to reproduce it, (3) not publicly disclose it before we patch, and (4) comply with this policy. Employees and contractors of MeshInfer.AI are not eligible.

PGP key

For highly sensitive reports, you may encrypt your disclosure using our PGP public key:

bash

# Download our PGP key from Keybase:
curl https://keybase.io/meshinfer_security/pgp_keys.asc | gpg --import

# Encrypt your report:
gpg --armor --encrypt -r meshinfer_security your-report.txt

# Send the encrypted file to support@dosfi.ai

Timeline example

Here's what you can expect after submitting a report:

Day 1	We acknowledge receipt and assign a severity level.
Days 2–7	We investigate, reproduce the issue, and develop a fix.
Days 7–60	The fix is tested, deployed, and a security advisory is prepared.
Day 60–90	Public disclosure in our security advisories (you're credited).
Post-disclosure	We remain available to answer follow-up questions.

Questions?

Email support@dosfi.ai if you have questions about this policy or need clarification on reporting a vulnerability.