deepset
Top 1M siteProgram Details
Responsible security disclosure policy covering deepset.ai, the Haystack Enterprise Platform and the Haystack open-source framework. Receipt is acknowledged within five business days, researchers are asked to allow 90 days before public disclosure, and deepset commits to taking no adverse action against those who follow the policy. There is no formal bug bounty at present.
- Allows Disclosure
- Yes
- Disclosure Window
- 90 days
- Response SLA
- 5 business days
Rules & Testing
Excluded Methods
Scope (3 targets)
- deepset.ai and all subdomains web
- Haystack Enterprise Platform other
- Haystack open-source framework other
Out of Scope
Third-party services or integrations hosted by other providers, Non-production environments, unless the finding shows exploitable lateral movement into production, Vulnerabilities in upstream open-source dependencies not maintained by deepset, Best-practice reports such as missing security headers or SPF/DMARC suggestions, TLS configuration weaknesses such as older cipher suites, TLS 1.0 or SWEET32, Clickjacking on pages with no sensitive actions, Self-XSS that cannot be used to exploit other users, Missing cookie flags on non-sensitive cookies, Information disclosure without meaningful security risk, Content spoofing or text injection without demonstrable security impact, Automated scanner or AI output without manual validation
Security
- Preferred Languages
- English
security.txt
- Contact
- https://deepset.ai/disclosure/
- Policy
- https://deepset.ai/disclosure/
- Languages
- en
- Expires
- Aug 10, 2028