Security

In short

Found something? Tell us through the contact form and pick the AI Security topic. We will answer you, we will fix what needs fixing, and if you stayed inside the rules below we will treat your testing as authorised.

What is in scope

Today: this website, the systems that serve it, and anything we publish — code, models, prototypes, technical reports.

We do not have products in general availability, so there is no product scope to declare yet. When there is, each product will carry its own scope on its own page rather than inheriting a vague one from here.

How to report

Use the contact form and choose AI Security as the topic. It is the only reporting channel we publish, and it reaches the people who can act on the report rather than a queue.

Please report to us before disclosing publicly, so there is a chance to fix the issue first.

What to include

The difference between a report we can act on today and one that takes a week of correspondence is usually the level of detail in the first message.

What happens next

We acknowledge reports within three working days. We assess the issue and tell you what we found, including when we conclude it is not a vulnerability and why.

If it is one, we fix it and tell you when the fix is out. If a fix will take a while, we say so and keep you updated rather than going quiet.

These are deliberately modest targets. We would rather publish a commitment we can keep at our current size than a response-time table that looks impressive and gets missed.

Working safely

The rules of engagement, for testing on anything in scope:

• —Stop as soon as you have proof. Do not go further to see how far you can get.
• —Do not access, copy, alter or delete data that is not yours.
• —No denial-of-service, load testing, or anything that degrades the service for other people.
• —No social engineering, phishing, or physical attempts against anyone at Horizon Mind.
• —If you come across someone else's personal data, stop, do not keep a copy, and tell us.

What we commit to in return

Security research carried out in good faith and within the rules above is authorised. We will not pursue legal action over it, we will not report it to law enforcement as an attack, and if a third party raises a complaint about work done under this policy we will say publicly that it was authorised.

We will credit you by whatever name you give us, or leave you out of it entirely — your choice, asked before we publish anything.

This policy does not authorise you to act against anyone else's systems, and it cannot waive rights that belong to a third party.

Coordinated disclosure

We work to 90 days by default, and we are happy for you to publish sooner once a fix is out and you have confirmed it. If a shorter window matters to you, say so in the first message and we will tell you honestly whether we can meet it.

We will not ask you to stay quiet indefinitely, and we will not use a disclosure discussion to run out the clock.

We do not pay a bounty

There is no paid bug bounty programme, and we would rather say so on this page than let you find out after the work is done.

What we do offer is a real answer from someone who understands the report, a fix, and public credit if you want it.

Reporting issues in AI systems

This is the category we care most about, and the one most disclosure policies are silent on. For anything we publish — a model, an agent, a prototype, a pipeline — these are exactly the reports we want:

• —Prompt injection that crosses a boundary it should not, especially through indirect or retrieved content.
• —Agent behaviour that escapes its intended permissions, tools or scope.
• —Extraction of training data, system prompts, or other material that was not meant to come back out.
• —Evaluation or guardrail failures that hold up under an adversary rather than only in a demo.

Usually out of scope

Not a rejection list so much as a description of what we cannot act on. If you can demonstrate real impact from one of these, send it anyway.

How this site is built

Useful context before you start, and all of it observable: this is a static site. There is no database, no user accounts, no sessions, no payments and nothing stored server-side. The contact form persists nothing here — it forwards the submission to a delivery service and keeps no copy.

It is served over HTTPS, and the dependency list is deliberately small. We are describing the shape of the system, not claiming it is secure; that is what your report is for.

Changes, and how to reach us

This policy changes as the company does, and the date at the top records when. Anything else — a question about scope, a report that does not fit the form — goes through contact.