Found a weakness? Tell us.

We test other people’s AI for a living, so we want to hear about weaknesses in our own systems. Here is how to report one, what we promise in return, and what to leave alone.

Please send security reports to , not through the contact form or social media.

Send enough for us to see what you saw.

Send only as much of our data as you need to show the problem.

  1. What you found, and where: the address, page or feature.
  2. The steps to reproduce it.
  3. What someone could do with it.
  4. Screenshots or a short recording, if they help.
  5. How to reach you, and whether you want to be named when it is fixed.

You hear from us until the fix is live.

Here is what happens from the day your report arrives.

  1. We confirm

    That we have your report, and who is looking after it.

  2. We assess

    Whether we can reproduce it, how serious it is, and when we expect to fix it.

  3. We keep you posted

    With regular updates until it is fixed, and a note when the fix is live.

  4. We thank you

    By name or handle once the fix is live, if you want. We agree with you when it is safe to talk about it.

We treat good‑faith research as authorised.

If you follow this page, we will not take legal action against you or report you to the police.

Good faith means you

  • Test only what is in scope, below.
  • Stop as soon as you have shown the problem.
  • View, keep and change no more data than you need, and delete what you saw once we have fixed it.
  • Do not slow down or break the service for anyone else.
  • Give us time to fix it, and agree with us when to tell anyone else.

Test our own systems, and no one else’s.

This page cannot give you permission to test anyone else’s, including our clients’ or our providers’.

In scope

  • sunflower.consulting and its subdomains.
  • Forms on the site, such as Book a call.

Out of scope

  • Our clients’ systems. Report those to the client directly.
  • Services we use but do not run, such as our hosting or email. Report those to the provider.
  • Denial of service, load testing and spam.
  • Phishing or other social engineering of our team.
  • Physical access to our offices or devices.
  • Scanner output without a working example of the problem.