If you believe you’ve discovered a security vulnerability in Mage, please report it:

• Email: security@mage.ai
• Include:
  • Description of the issue
  • Steps to reproduce (if applicable)
  • Any relevant logs, screenshots, or proof-of-concept

We typically acknowledge reports within 3 business days.

We ask that you:

• Do not publicly disclose the issue until it has been investigated and resolved
• Avoid accessing, modifying, or deleting data that does not belong to you
• Act in good faith to avoid privacy violations or disruption

After receiving your report, we will:

• Triage and validate the issue
• Determine affected systems and scope
• Work on a fix and coordinate release

We may reach out for additional details during this process.

This policy applies to:

• mage.ai (including hosted environments)
• Official Mage repositories and services

Out of scope:

• Issues requiring unrealistic user interaction
• Reports without a clear security impact
• Vulnerabilities in third-party services not controlled by Mage

If you’re unsure whether something is in scope, feel free to reach out.