Security contact and responsible disclosure

National AI Feed, operated by Aigistry LLC. Last updated 5 November 2026.

This page tells security researchers and evaluators how to report a problem with the National AI Feed, where they may test, and what they can expect from us. It is a statement of good faith, not a contract, and Aigistry LLC does not offer a bug bounty.

1. How to report

Email admin@aigistry.com with the subject "Security report". Describe what you found, where, and the steps to reproduce it. Please do not include real personal data in a report. If you want to send details privately, say so in a first message and we will arrange a method.

2. Where you may test

• Sandbox (active testing welcome): https://sandbox.feed.aigistry.com is a separate test copy of the feed with its own server, database, signing keys and mail sender. Everything on it is fictional. You may probe it, try to break it and send it malformed requests. Keep to the limits in section 4.
• Production (reports welcome, active testing not invited): https://feed.aigistry.com is the live service. We welcome reports about it, including things you noticed while reading the public feed, the public key list or the verification kit. Please do not run scans, fuzzing, load or exploit attempts against it; use the sandbox for that.

3. What we are interested in

• Anything that lets someone publish, change, hide or backdate a signed entry, or forge a signature.
• Anything that exposes an API key, a sign-in link, a signing key or another organization's data.
• Flaws in the verification rules or the reference verifiers (Python, Node, PHP) that make a bad feed look valid.
• Weaknesses in sign-in, invitations, rate limits or the administration console.

4. Ground rules

• Test only the sandbox. Do not access, change or delete data that is not yours, and stop and tell us if you reach real personal data.
• No denial-of-service or load testing, no social engineering of Aigistry or of any organization using the feed, and no physical attacks.
• Do not test the accounts or systems of any real government, provider or platform.
• Give us a reasonable time to fix a problem before you publish details.
• Sandbox keys and entries are fictional and may be reset at any time without notice.

5. What you can expect

• We will acknowledge your report within three business days.
• We will tell you what we decide and, where we can, when it is fixed.
• If you follow this statement in good faith, Aigistry LLC will not take legal action against you for that testing and will not ask others to. This is a statement of intent by Aigistry LLC only; it cannot bind other organizations or authorities.
• On request and with your agreement we will credit you when a fix is announced.

6. What is already known

The public verification rules, kit and API description at feed.aigistry.com/verify/ state their own limits plainly (for example, that a signature proves consistency, not government authorization). Reports of those documented limits are welcome but are not new findings.

7. Machine-readable contact

Our security.txt names admin@aigistry.com and points to this page.