How do I report a security issue?
Email contact@countermove.xyz with the subject “Security”. You can also use the contact form with the topic “Security report”. Please include:
- the URL or endpoint affected and what the issue is;
- steps to reproduce it, with any requests, payloads or screenshots;
- what an attacker could do with it;
- how you would like to be credited, if at all.
Please keep the details private until we have fixed the issue or 90 days have passed, whichever is sooner, and talk to us before publishing.
What is in scope?
In scope: countermove.xyz and its pages, the form endpoints under /api/ (sign-up, confirmation and contact), and the emails those forms send.
Out of scope:
- the infrastructure of our providers, Vercel and Resend. Report issues there to Vercel or Resend directly;
- other sites we link to;
- denial-of-service, volumetric or load testing;
- findings without a demonstrated security impact, such as missing headers on static pages, banner or version disclosure, or results of automated scanners alone.
Countermove, the testing product, isn’t available yet, so there is nothing else to test.
What shouldn’t I do?
- Don’t access, copy, change or delete data that isn’t yours. If you reach personal data, stop, don’t keep it, and tell us.
- Don’t run denial-of-service attacks or anything that degrades the site for others.
- Don’t use social engineering, phishing or physical attacks against us, our providers or anyone else.
- Don’t submit other people’s email addresses to our forms or cause us to send email to anyone who didn’t ask for it. Use addresses you control, and keep the number of test submissions small.
- Don’t demand payment in exchange for a report.
Safe harbor
If you make a good-faith effort to follow this policy while researching countermove.xyz, we will consider your research authorized by us, we won’t start legal action against you or report you to law enforcement for it, and if someone else takes action against you for activity that followed this policy, we will make it known that your research was authorized by us. This commitment covers only Countermove and only systems in scope. We can’t authorize testing of our providers’ or anyone else’s systems, waive anyone else’s rights, or bind law enforcement. It doesn’t cover activity that breaks the rules on this page, such as accessing or keeping other people’s data, degrading the site or demanding payment. We may share your report with Vercel or Resend if we need them to fix the issue.
If you’re unsure whether something is allowed, ask us first at contact@countermove.xyz.
What happens after I report?
- We aim to acknowledge your report within 5 business days.
- We confirm whether we can reproduce it and keep you informed while we fix it.
- We tell you when it is fixed and, if you want, credit you by name.
We don’t run a paid bug bounty program.
Responsible use of the attack library
The attack families, scenarios and incidents on this site describe how people manipulate AI agents into giving away money. We publish them so the teams who build and run those agents can test and fix them before someone else finds the gap. The incidents are already public record, and defenders need the techniques written down to test against.
- Only test agents and systems you own, or that you have written permission to test.
- Don’t use these techniques on a live customer-facing agent to obtain refunds, discounts, credits or anything else you aren’t entitled to. That isn’t testing. It may be fraud.
- Test in a sandbox or staging environment where possible, with mocked payment and refund tools, so a successful attack moves no real money.
- If you find a weakness in someone else’s agent by accident, stop, don’t exploit it, and report it to the company through its security or disclosure contact.
These rules are also part of our terms of use.