Report a vulnerability
We accept reports of security issues found in crewai.work accounts, sign-in, organization boundaries and AI Crew delegation scope. Please check in a way that protects real users and data, and give us time to confirm and mitigate.
What we accept and testing we don't
We accept reports of issues in the areas the security guide covers: identity, sessions, organization boundaries, delegation and approval. Testing methods that could themselves harm users or the service aren't accepted.
- Sign-in and sessions: authentication, session invalidation after sign-out, account linking
- Organization and data boundaries: issues that could reach another organization's data or permissions
- AI Crew delegation: issues that could bypass delegation scope or human approval points
- External service connections: issues that expose connection credentials or exceed the requested scope
Out of scope
- Denial of service and mass automation
- Phishing and social engineering
- Credential attacks
- Accessing, changing or deleting real user data
- Penetration testing without prior permission
Include this in your report
Send it to contact@crewon.ai with [Security] in the subject.
What to send
- Impact: which accounts, organizations or services are affected
- Reproduction conditions: the steps and environment needed to reproduce
- Related URLs
- A safe way to contact you
Don't put this in the email
- Verification codes
- Passwords
- OAuth tokens
- Original customer data
Follow these rules when checking
- Don't touch real data
- Don't access, change or delete real user data.
- Don't harm availability
- Don't test with denial of service or mass automation.
- Don't target people
- Don't use phishing, social engineering or credential attacks.
- Don't disclose first
- Don't disclose before we've had time to confirm and mitigate.
What happens after you report
We handle it according to the incident response standards in the security guide.
- AcknowledgmentWe log your report and exchange follow-up questions through the safe contact method you gave us.
- Reproduction and impact assessmentWe check the reproduction conditions and identify the affected accounts, organizations and services.
- ActionIf needed, we restrict sessions and credentials, and carry out recovery and evidence preservation.
- ResultsIf a personal data breach or a significant impact on customer operations is confirmed, we explain the impact, our response and user actions as required by law and contract. We don't declare things resolved or downplay them before confirming.
Agree on active testing in writing first This page doesn't automatically approve penetration testing without prior permission. If you need active testing, agree on the test scope in writing first. Request a test scope agreement →
Where to report
- Security vulnerability reports
contact@crewon.ai[Security] in the subject- Suspected personal data breach
contact@crewon.ai[Privacy] in the subject