# If you find a weakness, tell us.

> We build security products, so we expect our own work to be tested. If you have found a weakness in something we run, write to security@whisper.security and we will treat you as a partner in fixing it. Our policy, records and keys are below.

*Source: https://www.whisper.security/security*
*Last updated: 2026-11-04*

---

- [Email security@whisper.security](mailto:security@whisper.security)
- [Read the disclosure policy](https://www.whisper.security/security/disclosure-policy)

## Policy, records and keys.

Everything below is a page or file we publish, so you can check it yourself.

- **[Vulnerability disclosure policy](https://www.whisper.security/security/disclosure-policy)**: What you can test, how to report it, what we commit to in return, and the safe harbour we give good-faith research.
- **[Abuse reports](https://www.whisper.security/security/abuse)**: How to report spam, scanning or attacks from AS219419, our prefixes or our agent identities, and what we do with a report.
- **[Threat intelligence disclosure](https://www.whisper.security/security/threat-intelligence-disclosure)**: Who we notify before we publish a finding about another organisation, how we label what we share, and how to ask for a correction.
- **[Advisories](https://www.whisper.security/security/advisories)**: Security advisories we publish, with affected and fixed versions, severity and credit.
- **[Acknowledgements](https://www.whisper.security/security/acknowledgments)**: Credit for the researchers who report to us, given with their consent.
- **[security.txt](https://www.whisper.security/.well-known/security.txt)**: Our security contact file. It is PGP-signed and carries an expiry date, as RFC 9116 sets out.
- **[OpenPGP key](https://www.whisper.security/.well-known/openpgp-key.txt)**: Encrypt a sensitive report with this key. Fingerprint: EFF1 663D 9925 3968 2106 A5EA D0F7 0908 CF3B 7929
- **[Status](https://status.whisper.security)**: The current state of the graph, this website and the MCP server, with their incident history.