Reporting a security problem.

Mail security@withadi.dev. It reaches the people who write the code, with no triage vendor in between. If the report is sensitive, encrypt it with our OpenPGP key; if that is a hurdle, send it in the clear rather than not sending it.

What to send

What you found, where you found it, and what someone gets by using it. Then the steps to reproduce it — a curl line or a short recording is worth more than a scanner report, which we will only end up reproducing by hand anyway. Tell us in the mail if you plan to publish, and when.

You will get a reply from a person: whether it is a bug, what happens next, and a note when it is fixed. This mailbox is new, so if a week passes in silence, resend — assume the mail went astray rather than that it was ignored.

The key

withadi.dev/.well-known/pgp-key.txt — RSA 4096, valid until 29 August 2028. Check it against the fingerprint printed in security.txt rather than against itself:

curl -s https://withadi.dev/.well-known/pgp-key.txt | gpg --import
gpg --fingerprint security@withadi.dev
# 5915 6325 8D26 58C8 A895  4A06 9A98 76BD 531B 558B

Scope

In scope, because they are ours to fix:

• withadi.dev and its subdomains — this site, and the services on it.
• ADI itself, as published at github.com/adi-family/mono and as shipped in the release builds this site links to.
• The release artefacts and the updater — anything that gets code onto a machine.

Out of scope:

• Infrastructure someone else runs — Cloudflare, GitHub, Google Workspace. Report those to them; we cannot grant permission to test another company's systems.
• Denial of service, volumetric or stress testing, and anything that degrades the service for others.
• Social engineering, phishing a person, and physical access.
• A missing header, a TLS setting or a dependency version with no path to impact behind it. Show what it lets an attacker do.

One thing is worth saying plainly, because ADI is not a web app. It runs on your own machine, as you. An agent that runs commands, a store you can read with cat, a tool that reaches the network — that is the product working as designed, not a finding. What we do want to hear about is anything reachable from outside that machine, any boundary we claim holds and does not (a project scope, a secret that decrypts when it should not, the front door serving something it was never pointed at), a secret written down in the clear, or a way to get code into a release.

While you are testing

• Use your own install and your own accounts. Other people's data is not yours to look at.
• Stop at proof. Enough to show the bug, then out — no pivoting, no exfiltration, nothing changed or deleted.
• If you reach personal data, stop there and say so in the report. Do not keep a copy.
• Keep automated scanners off this site. It is a static page in front of one mailbox; the noise arrives as nothing we can act on.

Safe harbour

Research done in good faith and within this page is authorised. We will not pursue legal action over it, will not report you to your hosting provider or to law enforcement for it, and will say so in writing if a third party asks. If you are not sure whether something is in bounds, ask first — that mail is welcome and gets the same reply. This promise is ours to make about our own systems; it cannot cover anyone else's.

There is no bounty yet

Reports are not paid at the moment. ADI has no published price and no revenue, and a reward we could not pay would be worse than no reward at all — so rather than leave that to be inferred, it is written here and in security.txt. It is a "not yet", not a position: if that changes, this page changes first.

What you do get is a straight answer about whether it is a bug, a fix you are told about, and credit here if you want it.

Credit

Nobody is listed here yet. If you would like your name or handle on this page, say so in the report and it goes up when the fix ships; staying anonymous is the default, and asking to be left off costs you nothing.

Last updated 30 August 2026 · this page is what /.well-known/security.txt names as its policy.