Contact and scope
Report a suspected unbound.ai vulnerability privately to support@unbound-me.com with the subject Security report. The team does not currently publish a dedicated encrypted disclosure channel, bug-bounty program, guaranteed response time or blanket testing authorization.
Provide the affected URL or component, a minimal reproduction, expected versus actual behavior, potential impact, and a request ID if available. Redact API keys, passwords, session cookies, wallet material and personal data. Explain how you can be contacted for follow-up.
Responsible handling
Do not access other users' data, spend their balance, claim their Seal links, withdraw funds, run denial-of-service attacks or expand an accidental finding. Stop when you have enough evidence to describe the issue. Ask for written scope before testing beyond your own account. Do not publicly disclose working secrets or personal records.
For your own leaked key, revoke it promptly in API keys; revoke affected MCP access and change your password where appropriate. Support cannot make a public-chain transaction reversible. Unexpected wallet activity should be reported immediately with public transaction identifiers, never a seed phrase.
Service measures and limits
Production uses HTTPS, secure session cookies, password hashing, scoped MCP access and server-side spending reservations. These measures reduce risk but are not a security certification or guarantee. The company wallet is server-controlled and encrypted at rest; administrators must protect its encryption key and backups. The security and privacy documentation will change as controls are validated.
