Our disclosure policy

We disclose first, and for free

When we find exposure affecting an organization, we tell them what we found and why it matters, at no cost and with no conditions.

We never tie a fix, our silence, or a timeline to payment. We do not ask to be paid to share a finding, to withhold it, or to wait.

Hiring us to help remediate is optional and separate. The organization can fix the issue on its own, use another firm, or hire us. The notice does not depend on that choice.

Outside-only without permission

Without authorization, we only look at publicly observable exposure. That includes internet-facing misconfigurations, leaked credentials in public sources, and public attack signals.

We only actively test systems covered by a published bug bounty or vulnerability disclosure program, or by a signed engagement. We stay inside that program’s scope and rules, or that engagement’s scope and rules.

Official channels, then a window

We report through the organization’s official channels: security.txt, a vulnerability disclosure program, a bug bounty platform, or a published security contact.

We follow coordinated disclosure. The default window is 90 days. We extend that window when the organization is actively fixing the issue. We do not publish exploitable details before a fix is in place, or before the agreed window ends.

We do not sell, trade, or exploit findings

We do not sell findings. We do not trade them. We do not exploit them.

We do not access, keep, or exfiltrate data beyond the minimum needed to confirm an issue. Any data we access by accident is deleted.

How to reach us

Security contact: [email protected]

If your organization has a preferred contact for these reports, tell us. Email [email protected] with the address or channel you want us to use.

Home · Company

Aligned Super Intelligence is operated by Boole AI, Inc.

This policy is not legal advice. We may update it.

Last updated November 8, 2026.