Agentik, Inc. (doing business as ‘Cleric’) welcomes reports from security researchers. If you believe you have found a security vulnerability in Cleric, please tell us so we can fix it. This policy explains what is in scope, how to report, what to expect from us, and the safe harbor we offer for research done in good faith.
We do not run a bug bounty program and do not offer payment for reports.
Scope
This policy covers:
- The Cleric web app (
*.app.cleric.ai) - The Cleric Slack app and MCP server
- The trial signup flow (cleric.ai/start)
The following are out of scope:
- Services run by third parties, even when they are served from a cleric.ai subdomain. Report those to the vendor.
- Another customer’s workspace or data. Test only against a trial account you created yourself.
- Denial of service, load testing, or anything that degrades the service for others.
- Social engineering, phishing, or physical attacks against Cleric staff, offices or infrastructure.
- Reports without a demonstrated security impact, such as missing security headers, email configuration (SPF, DKIM, DMARC), TLS cipher choices, clickjacking on pages without sensitive actions, or output from automated scanners.
How to report
Email security@cleric.ai. Please include:
- The affected URL, component or feature
- The type of vulnerability and its impact
- Step-by-step instructions to reproduce it, with a non-destructive proof of concept
- Your name or handle, if you would like credit
Please do not report vulnerabilities through support channels, social media or public issue trackers.
What to expect
When you report a vulnerability, we aim to:
- Acknowledge your report within 5 business days
- Confirm whether the issue is valid and share our assessment of its severity within 10 business days
- Keep you updated at least every 14 days until the issue is resolved
- Tell you when the issue is fixed
We prioritize fixes based on severity, impact and how easily the issue can be exploited. Please give us a reasonable amount of time to fix the issue before you share it publicly, and coordinate the timing of any disclosure with us.
Guidelines
When researching vulnerabilities, please:
- Access only the minimum data needed to demonstrate the issue. If you encounter personal data or another customer’s data, stop, do not copy or keep it, and tell us in your report.
- Do not modify or delete data, or change the configuration of any account other than your own.
- Avoid automated scanning that sends high volumes of traffic.
- Do not use a vulnerability beyond what is needed to confirm it, such as by moving laterally or keeping access.
- Securely delete any data you obtained once you have reported it to us.
Safe harbor
If you make a good-faith effort to follow this policy, we will consider your research authorized. We will not pursue or support legal action against you for it, and if a third party takes legal action against you for research that followed this policy, we will make it known that your activities were authorized.
Safe harbor does not cover activity that breaks the law, harms Cleric or its customers, or goes beyond the guidelines above. If you are unsure whether something is allowed, ask us at security@cleric.ai before you proceed.
We may update this policy from time to time. The effective date above shows when it last changed.