Security
If you find a weakness,
tell us.
We build security products, so we expect our own work to be tested. If you have found a weakness in something we run, write to security@whisper.security and we will treat you as a partner in fixing it. Our policy, records and keys are below.
Policy, records and keys.
Everything below is a page or file we publish, so you can check it yourself.
Vulnerability disclosure policy
What you can test, how to report it, what we commit to in return, and the safe harbour we give good-faith research.
Abuse reports
How to report spam, scanning or attacks from AS219419, our prefixes or our agent identities, and what we do with a report.
Threat intelligence disclosure
Who we notify before we publish a finding about another organisation, how we label what we share, and how to ask for a correction.
Advisories
Security advisories we publish, with affected and fixed versions, severity and credit.
Acknowledgements
Credit for the researchers who report to us, given with their consent.
security.txt
Our security contact file. It is PGP-signed and carries an expiry date, as RFC 9116 sets out.
OpenPGP key
Encrypt a sensitive report with this key.
Fingerprint: EFF1 663D 9925 3968 2106 A5EA D0F7 0908 CF3B 7929
Status
The current state of the graph, this website and the MCP server, with their incident history.