Security
This page says how to report a security problem in ToolsEnabled software privately, what we ask of you, and what we promise in return. Fleet ships the same policy with its source as SECURITY.md; this page extends it to every ToolsEnabled product and to this website.
Report a problem
Please report a security problem privately, not in a public issue:
- email security@toolsenabled.ai, or
- use "Report a vulnerability" on the repository's Security tab (GitHub's private reporting), which every product repository offers: TEAA, TEAA + FRA + Hub, Fleet V5, Knowledge, ToolsEngine, Fleet (Claude Code plugin), Fleet MCP, Data, Engine Bench, Head Gasket Bench, ToolsEnabled Bench and Sim. This page is the policy for every repository, whether or not it also carries a copy as SECURITY.md.
For your ToolsEnabled account, the hosted service and this website, use email.
Reports from anyone are welcome, including from the directories that list our plugins. Tell us the product and version (for a plugin, the version your agent CLI's plugin list shows), what you found, and how to reproduce it.
We read every report, reply as soon as we can, keep you informed while we fix it, tell you when the fix is released, and credit you in the release notes if you want that.
The latest release of each product is the supported one; fixes ship as a new release.
What we ask
Good faith means:
- you test on computers, accounts and projects that are yours or that you have permission to use;
- you stop once you can show the problem, and do not use it to go further;
- you do not access, change or keep other people's data beyond what you need to show the problem, and you delete it afterwards;
- you do not disrupt services or other people;
- you give us a reasonable chance to fix the problem before you publish it. We will not ask you to stay silent indefinitely; if we have not fixed it within 90 days of your report, you may publish.
If you are unsure whether something is covered, ask us first at the addresses above.
Safe harbor
We want people to look for problems in our software, and we will not treat good-faith research as an attack.
If you research and report in good faith under this policy:
- we consider your research authorized, and we will not bring or support any legal action against you for it, including under anti-hacking, anti-circumvention or similar laws;
- we waive any part of our own terms that would otherwise stop you from doing that research;
- if someone else takes legal action against you for research that followed this policy, we will make it known that your research was authorized by us.
This safe harbor covers ToolsEnabled's own code and releases. It cannot grant permission for other parties' systems: report a problem in an agent CLI, a model provider or any other software we did not write to its own maker.
Rewards
ToolsEnabled is a small, self-funded company. We do not pay rewards for reports. We are grateful for every one, and we will credit you publicly if you want that.
No warranty
ToolsEnabled software is provided "as is", without warranty of any kind, as the terms say. This page does not change that. It says how we handle reports, not that any release is free of problems.
security.txt
These contacts are also published in the RFC 9116 format at /.well-known/security.txt.
Contact
Security lead: Joshua Pinckard, Founder & CEO (security@toolsenabled.ai)
ToolsEnabled, Inc. · security@toolsenabled.ai · for anything that is not a security problem, see Support.