Security policy

Last updated: 2026-07-01 · Machine-readable: /.well-known/security.txt

Inner is a supply-chain security product. If you found a vulnerability in Inner itself, thank you. This page explains how to report it and what to expect.

Reporting

Email security@getinner.ai with:

A description of the issue.
Steps to reproduce (or a proof-of-concept).
Your assessment of impact.
Whether you're willing to be credited.

For sensitive reports, request our PGP key first via the same address.

Do not open a public issue, tweet the finding, or scan real customer packages to test. See "Safe harbor" below for what we authorize.

Response commitments

Severity	Ack within	Fix target
Critical (RCE, sandbox escape, verdict-signature forgery)	24h	7d
High (auth bypass, admin escalation, DoS with easy vector)	3 business days	30d
Medium (info disclosure, weak validation)	5 business days	60d
Low	10 business days	Next release

Scope

In scope:

The Inner web application (getinner.ai) and API (/api/*)
The Inner scanning engine and sandbox runtime
The published @inner/* npm packages and the inner CLI
Verdict signatures + the public engine key

Out of scope:

Third-party services we depend on (Vercel, Supabase, AWS, OpenAI) — report to them directly.
Denial-of-service via volumetric attacks.
Social engineering of our team or contractors.

Safe harbor

We will not pursue civil or criminal action against researchers who:

Report vulnerabilities in scope in good faith.
Do not access, modify, or destroy data belonging to other users.
Do not disrupt the Service beyond what's minimally necessary to demonstrate the issue.
Give us reasonable time to remediate before public disclosure — 90 days by default; less if we agree, more if we ask.

Bug bounty

We are not currently running a paid bounty program. We publicly credit reporters (with permission) and are happy to provide LinkedIn / GitHub endorsements. Once we're funded past pre-seed, we'll formalize a paid program.

Coordinated disclosure

If a vulnerability affects the broader supply-chain ecosystem (npm, PyPI, or a specific package we scanned that turned out to be actually malicious), we will coordinate disclosure with the relevant registry, OSV, and GHSA. We'll credit you consistently across channels.