Report a vulnerability
Send a private message to Pablo on LinkedIn with the affected component, steps to reproduce, likely impact, and any suggested remediation. Begin the message with “Security report.” We will acknowledge a useful report and work toward a proportionate fix.
Research boundaries
- Use accounts, sessions, devices, and data you own or are authorized to test.
- Do not alter data, interrupt services, access another person’s information, or use social engineering.
- Stop and report if testing could affect a physical machine or another user.
- Give us reasonable time to investigate before public disclosure.
Physical-machine safety
RoboRun can send commands to robots. Begin in simulation, keep a tested emergency stop available, establish conservative motion limits, maintain physical clearance, and follow the hardware manufacturer’s safety guidance. Do not treat a language model as a real-time safety controller.
Open-source issues
Ordinary bugs can be filed on GitHub. Please send security-sensitive details privately first. This page describes a disclosure channel and does not promise a paid bug bounty.