{
 "url": "https://agenticweb.wiki/security/",
 "title": "Security policy · agenticweb.wiki",
 "description": "Vulnerability disclosure policy, safe harbour, and SSRF/prompt-injection security controls for agenticweb.wiki.",
 "markdown_url": "https://agenticweb.wiki/security/index.md",
 "markdown": "# Security & vulnerability disclosure policy\n\nHow to report a security issue affecting agenticweb.wiki or the wiki.agenticweb/probe MCP server, our safe-harbour commitment for good-faith researchers, and the architectural controls guarding the probe worker.\n\n## Reporting a vulnerability\n\n- Email: [info@belgravialabs.com](mailto:info@belgravialabs.com) (subject line: [SECURITY] agenticweb.wiki).\n\n- RFC 9116 manifest: [https://agenticweb.wiki/.well-known/security.txt](/.well-known/security.txt)\n\n- Response SLA: We acknowledge reports within 48 hours and aim to ship verified fixes to our Cloudflare Worker edge within 72 hours of triage.\n\n## Scope & safe harbour\n\nGood-faith security research against agenticweb.wiki and https://agenticweb.wiki/mcp that respects our published rate limits, avoids denial-of-service floods, and does not target third-party origins through our probe tools is authorized under this policy. Please test SSRF or parser edge cases using domains you control rather than third-party infrastructure.\n\n## Security architecture of the MCP server\n\n- Zero server-side credentials on public tools: All 11 MCP tools are unauthenticated and read-only. The Worker holds no user OAuth tokens, payment keys, or session secrets that could leak across callers.\n\n- Per-hop SSRF prevention: Every outbound fetch in has, probe, and validate_manifest resolves DNS over HTTPS and validates all returned A/AAAA records against RFC 1918, loopback, link-local, carrier-grade NAT, cloud metadata (169.254.169.254), and IPv6 private ranges before connecting and at every HTTP redirect hop (capped at 3 hops).\n\n- Indirect prompt-injection mitigation: Outbound probes never return raw third-party HTML or prose bodies into the MCP tool response. Only deterministic counts, booleans, and schema-validated fields are extracted, and responses are tagged with content_trust: \"untrusted_external_origin\".\n\n- Edge rate limiting: Per-client IPv4 / IPv6 /64 and per-target-origin rate limiters protect both the Worker and third-party origins from amplification.\n\nLast updated 2026-10-25 · Canonical RFC 9116 file: [/.well-known/security.txt](/.well-known/security.txt).\n"
}