# Agentic Engineering Platform security reporting
# Format: RFC 9116. The contact form opens with Security or privacy selected.

Contact: https://lockedinlabs.ai/contact/?topic=security&source_path=engineering-security&cta=security_report
Expires: 2027-08-19T00:00:00.000Z
Preferred-Languages: en
Canonical: https://engineering.lockedinlabs.ai/.well-known/security.txt
Policy: https://engineering.lockedinlabs.ai/security

# WHAT THE POLICY LINK LEADS TO. Not a bug-bounty page — there is no bounty, and
# saying so plainly is the point. /security is the third-party risk page. Every
# claim on it carries a standing of Live, Proposed or Not held, and the sections
# marked Not held say which attestations this product lacks; a researcher who
# reads those first will find several standing gaps already written down, which
# should save both sides a report. That section sits tenth of eleven, after the
# implemented controls and their dated evidence, and a release test pins it
# there deliberately.
#
# NOT IN SCOPE, and stated here so nobody spends an afternoon on one: a version
# banner, TLS configuration owned by the managed host, and any finding that
# requires an already-compromised operator credential. Also out of scope, and
# named because a header scanner will flag it within seconds: `script-src` on
# the cached marketing pages permits 'unsafe-inline'. That is known, deliberate
# and documented — a per-request nonce cannot exist on a document served from a
# CDN cache, and the routes that render per request, which is all of /app and
# both sign-in forms, do carry one. Tenant isolation IS in scope and is the
# finding we most want.