Security
Found something? Tell us first.
Security at SecondFirst is founder-led. A report reaches the person who fixes it.
Reporting a vulnerability
- Security lead
- Xiayang Zhang (Leo), founder & director
- Report to
- [email protected]
- In scope
- secondfirst.ai, openmcp.app and their subdomains, and our open-source code on GitHub
- We reply
- Within 3 business days, and keep you updated until it’s fixed
- We ask
- Give us reasonable time to fix before you publish. Test only with your own accounts and data. No service disruption, no social engineering.
- Safe harbour
- We won’t pursue legal action over good-faith research that follows these rules.
- Bug bounty
- None yet. We credit reporters who want it.
- Client systems
- We test only systems we run, or a client’s own systems under their written authorization.
- Machine-readable
- /.well-known/security.txt