Responsible Disclosure Policy

We value the work of security researchers. This policy explains how to report vulnerabilities to ACATHRCA and what you can expect from us.

• wellxai.world
• chatgiza.com and the ChatGiZa web app
• ChatGiZa Agent for Visual Studio Code

In scope: issues that could compromise the confidentiality, integrity or availability of our systems or user data.

Out of scope: denial-of-service testing, social engineering of our staff, physical attacks, and reports about model outputs (such as jailbreaks) unless they expose other users' data. Report harmful outputs through our abuse channel instead.

Email security@wellxai.world with a description of the issue, steps to reproduce it, and its potential impact. Please do not share the issue publicly until we have had a reasonable chance to fix it.

• We will acknowledge your report promptly.
• We will keep you informed as we investigate and fix the issue.
• We will credit you publicly if you wish, once the issue is resolved.

If you act in good faith, follow this policy, avoid privacy violations and service disruption, and only access the data needed to demonstrate the issue, we will not pursue legal action against you for your research.

We may update this policy. The current version is always published on this page.