Contact: mailto:security@monegai.com
Contact: mailto:hello@monegai.com
Expires: 2027-10-17T00:00:00.000Z
Preferred-Languages: en, it, fr
Canonical: https://monegai.com/.well-known/security.txt
Policy: https://monegai.com/.well-known/ai.txt

Encryption: mailto:security@monegai.com?subject=MonegAI%20PGP%20key%20request
Encryption: https://monegai.com/.well-known/security.txt

Acknowledgments: /.well-known/security.txt
Acknowledgments: /llms.txt

Hiring: https://monegai.com/contact.html

# RFC 9116 - security.txt for MonegAI
#
# MonegAI is a desktop product with no server-side component: the website is
# static and the browser keeps everything on the user's machine. The most
# valuable reports we can receive are therefore:
#
#   1. Vulnerabilities in the desktop application (the Electron main process,
#      the preload bridge, the webview guest sandboxing, or the local AI
#      server).
#   2. Escaping the guest sandbox from a web page.
#   3. Unauthorised network transmission of content the user expects to stay
#      local.
#   4. Anything on this website itself.
#
# Please encrypt your report and request our PGP key by mail if you need to
# report something sensitive. We aim to acknowledge within a few hours and to
# keep reporters informed until a fix ships.