Security
We want to hear about security problems in our products and services. This page explains how to report a vulnerability and what you can expect from us.
Scope
- AI Passport, including its Mac app (formerly Forkit Connect; all released versions, including the beta).
- This website, www.forkit-ai.com, and its internal hub.forkit-ai.com.
- Forkit services under forkit.dev.
How to report
Email developer@forkit.dev with the subject “Security report”. Please include:
- the affected product, version or URL;
- a description of the problem and its impact;
- steps to reproduce, or a proof of concept;
- whether you know it is being exploited;
- how you would like to be credited, if at all.
Please do not include personal data of other people, and do not send secrets you may have obtained. An encryption key (PGP) is not published yet. Our machine-readable contact is at /.well-known/security.txt.
What happens next
| Step | Target |
|---|---|
| Acknowledgement of your report | within 3 working days |
| First assessment (validity and severity) | within 10 working days |
| Status updates while we work on a fix | at least every 14 days |
| Fix or mitigation for critical and high severity issues | as fast as possible, aiming for 30 days |
Security fixes for AI Passport (the Mac app, formerly Forkit Connect) ship as signed releases with release notes. If a vulnerability in a product is actively exploited, we notify it through ENISA's Single Reporting Platform as the EU Cyber Resilience Act requires (early warning within 24 hours of becoming aware, notification within 72 hours) and inform affected users.
Coordinated disclosure
We ask you to give us reasonable time to fix a problem before you publish it. By default we agree a disclosure date with you, at the latest 90 days after your report, or earlier once a fix is released. If a problem is exploited in the wild, we may agree to publish sooner. We credit reporters who wish to be named.
Good-faith research
We will not take legal action against research done in good faith within this policy: avoid harm to users and data, do not access or change data that is not yours beyond what is needed to show the problem, do not degrade our services (no denial-of-service or spam), and do not use social engineering or physical attacks. We do not run a paid bug bounty programme at this time.
Policy version 1 · 26 October 2026