# Security Security # Reporting a vulnerability Antecedint serves API keys, OAuth tokens and unpublished claim text to law firms and legal AI companies. If you find a way to reach any of it that you should not, email [security@antecedint.com](mailto:security@antecedint.com?subject=Security%20report). You may test the systems listed below under the rules on this page. ## In scope - mcp.antecedint.com: The REST API, the MCP server, and the OAuth authorization server under /oauth and /.well-known. - antecedint.com: This site, including the account pages, the API sandbox and the documentation. ## Out of scope - Services we use but do not run: sign-in pages hosted by Clerk, checkout hosted by Stripe, and Google Workspace. Report those to the vendor. - Scanner output without a demonstrated effect, such as a missing header, a TLS cipher list, or an SPF or DMARC setting. - Open client registration at /oauth/register on its own. MCP clients register themselves on first connection, so the endpoint is public by design; every client still needs a signed-in person to approve it on our consent page. - Findings that need denial of service, physical access, or access to a victim’s unlocked device. ## Rules for testing 1. Test with accounts and API keys you created. A free evaluation key is available from the account page after sign-in. 2. Do not read, change or delete data that belongs to anyone else. If a test reaches someone else’s data, stop, keep no copy, and tell us what you saw. 3. Keep automated traffic within the rate limits your key reports. No load testing and no denial of service. 4. No phishing, social engineering or physical attempts against our staff or customers. 5. Give us 90 days, or until a fix ships if that is sooner, before you publish details. ## Safe harbour If you follow the rules above in good faith, we treat your testing as authorised under our [Terms of Service](https://antecedint.com/terms), we will not bring or support legal action against you for it, and if a third party does, we will say publicly that you acted under this policy. If you are unsure whether a test fits the rules, ask first. ## What to send The URL or tool involved, the steps that reproduce it, and what an attacker gains. Include the request and response where you can, with your own credentials removed. If you reached another person's data, describe it rather than attaching it. We reply within 3 business days, tell you whether we can reproduce the issue, and tell you when a fix ships. We ask for 90 days before you publish, or less if the fix is out sooner. ## Rewards We do not pay bounties. With your permission, we list your name below once the fix ships, with a line on what you found. ## Thanks No reports credited yet.