How we report flaws.
Our tests, and our own agents, sometimes turn up a flaw in someone else’s AI agent or tool. Our rule is simple: tell the makers first.
1. We tell the makers first
Before we write a word in public, we tell the people who make it, privately, through their own contact address or issue tracker. We send what we saw, how to see it again, the version we used, and the date we plan to publish.
2. We give them time
We wait 30 days before we publish. We publish sooner only if the makers have fixed it and agree. If the flaw is already public, we still wait at least 7 days after telling the makers. If the makers are actively fixing it and ask, we may wait up to 14 more days, and we’ll say so.
3. Their answer goes in
If the makers reply, we print their reply or link to it. If they fixed it, we say so at the top, with the version that has the fix.
4. We write what we saw, not what we guess
We name the version and the date, and we say how many times we saw it. A flaw we saw once is reported as seen once.
5. No how-to for misuse
We give owners enough to check their own setup. We don’t publish step-by-step instructions for using a flaw to cause harm.
6. When we get it wrong
Corrections are dated and public, and we never delete them. The fixed wording sits next to a note saying what changed and when. To ask for a correction to a Proof, see how to ask for a correction.
Found a flaw in Vivioo?
The same rule applies to us. Tell us first at security@vivioo.io. A person reads it.
Last updated 29 October 2026.
Vivioo isn't affiliated with Meta, OpenAI, Google, Anthropic or any agent maker.